Notices
Computer & Technology Related Post here for help and discussion of computing and related technology. Internet, TVs, phones, consoles, computers, tablets and any other gadgets.

Critical security flaw in Explorer (now there's a suprise)

Thread Tools
 
Search this Thread
 
Old 29 June 2004, 12:16 PM
  #1  
ALi-B
Moderator
Support Scoobynet!
Thread Starter
iTrader: (1)
 
ALi-B's Avatar
 
Join Date: Apr 2002
Location: The hell where youth and laughter go
Posts: 38,034
Received 301 Likes on 240 Posts
Thumbs down Critical security flaw in Explorer (now there's a suprise)

I know everyone start thinking this is scare mongering, those in the know will already be aware and already know not to use explorer anyway.

But I recieved an e-mail warning of critical security hole in explorer, I did initially think it was scaremongering that we get so often. But seeing it was sent from a bonafied source I thought I'd just check:

Low and behold it's true

From the horses mouth: http://www.microsoft.com/security/in...load_ject.mspx

BBC news report: http://news.bbc.co.uk/2/hi/technology/3840101.stm

So everyone please make sure your virus software is bang up to date at the very least!
Old 29 June 2004, 12:44 PM
  #2  
BlkKnight
Scooby Regular
 
BlkKnight's Avatar
 
Join Date: Feb 2004
Location: High Wycombe
Posts: 3,763
Likes: 0
Received 0 Likes on 0 Posts
Default

use mozilla!

http://www.mozilla.org/products/firefox/
Old 29 June 2004, 02:03 PM
  #3  
BlkKnight
Scooby Regular
 
BlkKnight's Avatar
 
Join Date: Feb 2004
Location: High Wycombe
Posts: 3,763
Likes: 0
Received 0 Likes on 0 Posts
Default

http://www.theregister.co.uk/2004/06..._get_patching/
Old 29 June 2004, 02:18 PM
  #4  
stevencotton
Scooby Regular
 
stevencotton's Avatar
 
Join Date: Jan 2001
Location: behind twin turbos
Posts: 2,710
Likes: 0
Received 1 Like on 1 Post
Default

The sooner everyone stops using IE the better. Microsoft are no longer adding features to IE, so that's the way it's going to be until the new OS comes out - which is very bad for a few reasons.

Ditch IE!
Old 29 June 2004, 02:29 PM
  #5  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

I really hope that people do start taking notice of this and switching browsers. IE isn't even close to being standards compliant and its a nightmare just trying to get sites to work on it and still work in others. It's CSS rendering is bloody useless!

Take the advice above and move to Mozzilla, FireFox, Opera anything! Most other browsers are standards complient as they are constantly being updated by open source developers.
Old 29 June 2004, 02:32 PM
  #6  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

Just thought to add, any developers out there who work with banks could do with seeing this too.

Natwest RBS and a few others only work in IE because their coders are too lazy to take off the javascript detection. The more people that move over the more it encourages them to do some work
Old 29 June 2004, 02:51 PM
  #7  
M J B
Scooby Regular
 
M J B's Avatar
 
Join Date: Feb 2003
Posts: 494
Likes: 0
Received 0 Likes on 0 Posts
Default

What are the +'s and -'s of Mozilla, FireFox and Opera? I have never used any of them.

Cheers

Last edited by M J B; 29 June 2004 at 02:57 PM.
Old 29 June 2004, 03:04 PM
  #8  
stevencotton
Scooby Regular
 
stevencotton's Avatar
 
Join Date: Jan 2001
Location: behind twin turbos
Posts: 2,710
Likes: 0
Received 1 Like on 1 Post
Default

Problems with MS software are so common that people just take it for granted. It's become part of daily life. Pretty much everyone knows there's another problem with another bit of MS software around the corner, so it comes as no surprise.

The other browsers are all better than IE for many reasons, here's a small list:

* Better security
It's not tied directly into your underlying OS
* Better compliancy
MS just don't care about standards, the way they see it, one day everyone will be using their products so standards don't matter. IE doesn't even do a proper TCP handshake.
* Less bloated apps
Better programmers elsewhere
* Better features
I don't use Opera anymore (because 6.03 sucks on OS X) but Opera 7 for Windows is so packed full of useful stuff it's untrue.
* Speedier fixes and upgrades
MS moves slow.

People have to make up their own minds of course but I really can't think of any reason why anyone would use IE when there is such a choice. Sure, some people aren't even aware but those that are ... I don't get it?
Old 29 June 2004, 03:26 PM
  #9  
what would scooby do
Scooby Senior
 
what would scooby do's Avatar
 
Join Date: Aug 2002
Location: 52 Festive Road
Posts: 28,311
Likes: 0
Received 0 Likes on 0 Posts
Default

I would dearly love to move to mozilla today. Ihave been testing it for several weeks. Quite a few sites will not work with Mozilla, and it is actually slower than IE6 when you have large amounts of bandwidth. I've tried the full mozilla client and firefox.. just have to wait for next versions.
Old 29 June 2004, 03:39 PM
  #10  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by stevencotton
Problems with MS software are so common that people just take it for granted. It's become part of daily life. Pretty much everyone knows there's another problem with another bit of MS software around the corner, so it comes as no surprise.
An interesting perspective on this was written earlier this month on the excellent Daring Fireball site:

http://daringfireball.net/2004/06/broken_windows
Old 29 June 2004, 04:37 PM
  #11  
JackClark
Scooby Senior
 
JackClark's Avatar
 
Join Date: Dec 2000
Location: Overdosed on LCD
Posts: 20,852
Received 51 Likes on 34 Posts
Default

Very interesting article. I'd like to bring age into the equation, just wait until the little Johnnys have a Mac at home rather than a PC to practice and share with other similarly equip Johnnys what he and his Johnny mates are teaching each other at school. Correct me if I'm wrong but Boys don't like Mac's or Girls they like Cars, PC's and troublemaking.
Old 29 June 2004, 04:49 PM
  #12  
GaryK
Scooby Regular
 
GaryK's Avatar
 
Join Date: Sep 1999
Location: Bedfordshire
Posts: 4,037
Likes: 0
Received 0 Likes on 0 Posts
Default

totally agree steven, I use mozilla 95% of the time but unfortunately there are a few sites that it does a browser detection and refuses to work (national lottery being one of em - tossers!).

When the f**k will m$ learn and sort all this crap out. I dont see it being an issue on the mac because as pointed out the holes are because of the way IE is integrated into the OS which is what makes many of M$ products very poor security wise, you should be writing apps that sit on top of the kernel not overlap with it.

Gary
Old 29 June 2004, 04:49 PM
  #13  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by JackClark
Very interesting article. I'd like to bring age into the equation, just wait until the little Johnnys have a Mac at home rather than a PC to practice and share with other similarly equip Johnnys what he and his Johnny mates are teaching each other at school. Correct me if I'm wrong but Boys don't like Mac's or Girls they like Cars, PC's and troublemaking.
I am unsure as to what you are saying Jack.
Old 29 June 2004, 04:57 PM
  #14  
ChrisB
Moderator
 
ChrisB's Avatar
 
Join Date: Dec 1998
Location: Staffs
Posts: 23,573
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by stevencotton
Problems with MS software are so common that people just take it for granted. It's become part of daily life. Pretty much everyone knows there's another problem with another bit of MS software around the corner, so it comes as no surprise.
True but then so many people use it, the patches gets lot of publicity. I could write a browser with a huge security flaw but if only 10 people used it, the BBC isn't going to be writing about it...

That said, I use NetCaptor to give me tabbed browsing with IE. Which of the open source browsers is going to be worth looking at?

Chris.
Old 29 June 2004, 05:10 PM
  #15  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

The BBC (and other worldwide news reports) reported very negatively on a flaw OSX had even though it had not been exploited and no real world examples were found. So I don't agree with you here. The user base things is an over-used but mostly unfounded excuse for legitimate security holes that are embedded within the system itself.

As for what browser to use, I believe that Mozilla is the most popular / reliable.
Old 29 June 2004, 05:27 PM
  #16  
stevencotton
Scooby Regular
 
stevencotton's Avatar
 
Join Date: Jan 2001
Location: behind twin turbos
Posts: 2,710
Likes: 0
Received 1 Like on 1 Post
Default

Reason for the publicity is purely because so many people are affected and of the seriousness of the flaw. It's pretty bad when your webserver can infect clients, laughably so The non-IT media has been slow to pick up on these threats but their reporting is increasing. Apart from the OS X one mentioned above I don't recall ever reading about a software flaw in say, Sendmail or Apache, on the mainstream news, and they are reasonably popular choices

I use Firefox for tabbed browsing on my PC, but I also use Opera too. I like Operas mouse gestures but Firefox has better CSS support.
Old 29 June 2004, 06:02 PM
  #17  
_Meridian_
Scooby Regular
iTrader: (1)
 
_Meridian_'s Avatar
 
Join Date: Jun 2004
Location: Mancs
Posts: 2,806
Likes: 0
Received 1 Like on 1 Post
Default

Originally Posted by angrynorth
The BBC (and other worldwide news reports) reported very negatively on a flaw OSX had even though it had not been exploited and no real world examples were found.

What most hackers actually do is wait until M$ release a patch for a security loophole. They work out what the loophole patched, then attack the millions of unpatched computers. Bearing in mind that a significant fraction of people NEVER patch their OS, this makes it easier for them. So the fact it hasn't been exploited yet means nothing - Blaster hit the headlines weeks or even months after the patch was issued.


M
Old 29 June 2004, 06:39 PM
  #18  
angrynorth
Scooby Regular
 
angrynorth's Avatar
 
Join Date: Oct 2004
Location: Was Manc now Camden
Posts: 2,689
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by _Meridian_
What most hackers actually do is wait until M$ release a patch for a security loophole. They work out what the loophole patched, then attack the millions of unpatched computers. Bearing in mind that a significant fraction of people NEVER patch their OS, this makes it easier for them. So the fact it hasn't been exploited yet means nothing - Blaster hit the headlines weeks or even months after the patch was issued.


M
I don't think this is generally the case, usually virus's appear after some hacker goes digging and finds a hole, they generally then send that information off to Microsoft and they get working on the patch asap. In the meantime between the holes discovery and the patch release, word spreads about the hole and ends up in the wrong hands. The virus then makes its way around then MS get the patch out to remove it.

This is how even experienced users end up with their system compromised.

We do however have a resident expert who could clear this up easily.

This particular chasm, though spreads silently and affects all versions unless they are running the scarce service pack. Even if that is installed afterwards then the system is still holey and browsing is reccommended by MS themselves in High Security (sic) mode.
Old 29 June 2004, 07:49 PM
  #19  
Simes777
Scooby Regular
 
Simes777's Avatar
 
Join Date: Nov 2001
Location: Aylesbury
Posts: 437
Likes: 0
Received 0 Likes on 0 Posts
Default

Just downloaded Mozilla Firefox. Looks OK but......

Can't access Scoobynet (and it's slower).

Simes
Old 29 June 2004, 07:53 PM
  #20  
what would scooby do
Scooby Senior
 
what would scooby do's Avatar
 
Join Date: Aug 2002
Location: 52 Festive Road
Posts: 28,311
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by Simes777
Just downloaded Mozilla Firefox. Looks OK but......

Can't access Scoobynet (and it's slower).

Simes
I'm using mozilla now so it does work with SN.. but yes it's sloooooooooow
Old 29 June 2004, 08:01 PM
  #21  
Simes777
Scooby Regular
 
Simes777's Avatar
 
Join Date: Nov 2001
Location: Aylesbury
Posts: 437
Likes: 0
Received 0 Likes on 0 Posts
Default

Interesting WWSD. I just get garbage. But I'll keep trying...
Old 30 June 2004, 09:57 AM
  #22  
DJ140
Scooby Regular
 
DJ140's Avatar
 
Join Date: Oct 2001
Location: North Yorks, MY03 PPP, now run a Mondeo ST TDCI 06
Posts: 1,032
Likes: 0
Received 0 Likes on 0 Posts
Default

I tried Mozilla and agree it's slower than IE and didn't work on all web sites. So went back to IE, which is very fast and IMO secure.

I run Norton IS, have a broadband connection and have not had a virus since it was installed. Is this just good luck?

Dan
Old 30 June 2004, 10:15 AM
  #23  
stevencotton
Scooby Regular
 
stevencotton's Avatar
 
Join Date: Jan 2001
Location: behind twin turbos
Posts: 2,710
Likes: 0
Received 1 Like on 1 Post
Default

Originally Posted by DJ140
I tried Mozilla and agree it's slower than IE and didn't work on all web sites. So went back to IE, which is very fast and IMO secure.

I run Norton IS, have a broadband connection and have not had a virus since it was installed. Is this just good luck?

Dan
Yes, complete luck. IE is _not_ secure. Perhaps your cache needs repopulating. I sit behind a squid proxy, Firefox on my windows machine is still faster than IE6.

IE also uses tricks to make it work faster with IIS webservers. SN uses IIS. When you say "didn't work on some websites" what do you mean, it doesn't work at all or some features are missing?

Give it a few days, I'm amazed at how many people seem to have speed issues. Personally I think it's perceived, I've tried IE and Firefox back to back and there is no speed penalty that I can see on my setup, and it's a mere Athlon XP1900.

Steve.
Old 30 June 2004, 07:53 PM
  #24  
_Meridian_
Scooby Regular
iTrader: (1)
 
_Meridian_'s Avatar
 
Join Date: Jun 2004
Location: Mancs
Posts: 2,806
Likes: 0
Received 1 Like on 1 Post
Default

As I understand it, Firefox and IE load pages differently: IE waits until the whole page is in cache, then puts it on the screen, while Firefox loads the background, then adds the pics etc on the fly. This means some sites will load faster with one, some with the other.

I've tried Firefox, but unless someone has a fix for the tiresome bug where going back a page always puts you back at the top of the previous page, not at the last scroll point, I've abandoned it. Have you any idea how annoying that is if you are a mod on a busy forum? I use it with Linux when my Linux box is working (teach me to put distros on a Deathstar...), but not Windows.

And am I the only person who can't see what the fuss about tabbed browsing is all about? So what.


M
Old 30 June 2004, 11:37 PM
  #25  
ALi-B
Moderator
Support Scoobynet!
Thread Starter
iTrader: (1)
 
ALi-B's Avatar
 
Join Date: Apr 2002
Location: The hell where youth and laughter go
Posts: 38,034
Received 301 Likes on 240 Posts
Default

teach me to put distros on a Deathstar
I can sympathise - IBM crap
Old 01 July 2004, 09:18 AM
  #26  
GaryK
Scooby Regular
 
GaryK's Avatar
 
Join Date: Sep 1999
Location: Bedfordshire
Posts: 4,037
Likes: 0
Received 0 Likes on 0 Posts
Default

Yep I agree with steve, I would say performance wise mozilla is on a par with IE5, I had to upgrade to IE6 which I didnt want to and that sucks, performance wise mozilla is faster than IE6 which is crap!
Old 01 July 2004, 07:03 PM
  #27  
DJ140
Scooby Regular
 
DJ140's Avatar
 
Join Date: Oct 2001
Location: North Yorks, MY03 PPP, now run a Mondeo ST TDCI 06
Posts: 1,032
Likes: 0
Received 0 Likes on 0 Posts
Default

Gary, rather a sweeping statement I would say. IE6 is not crap, it works well for most people.

The problem is it's a Microsoft product, so any "techie" type will immediately slam it as being useless, along with Windows, Office, Outlook etc etc.

I'm sure a Linux PC running Firebox is the way to go though, maybe one or the other will catch on one day!

Dan
Old 01 July 2004, 07:50 PM
  #28  
Iain Young
Scooby Regular
 
Iain Young's Avatar
 
Join Date: Sep 1999
Location: Swindon, Wiltshire Xbox Gamertag: Gutgouger
Posts: 6,956
Likes: 0
Received 0 Likes on 0 Posts
Default

I'm a professional software developer who is currently trying to write (servlet driven) web applications which will work all popular browsers. As far as I can see (having worked closely with both the browsers and the browser developers), the pros and cons that I've found go something like this...


Internet Explorer 6.

Pretty secure, reliable and fast. Does implement the html standards reasonably well but also implements a load of other stuff which isn't in the standard. Web site developers exploit these non-standard elements and so making their websites non-accessable by other browsers (Natwest for example). Has a couple of annoying rendering errors (for example trying to display divs over the top of drop down selection boxes)

Netscape / Mozilla / Firefox

Possibly more secure than IE, however it is not as popular as IE and as such is not subject to the same amount of hacker activity, so it is difficult to say how much more secure. Javascript seems a little quicker, although not much, especially when handling large amounts of data. There are numerous issues with the rendering and placement of dynamic html elements, and like IE, it implements features which are not in the html standards, (although these doesn't seem to be as widely exploited as those in IE).

Opera

A bit of a joke. Does not correctly implement the html standards in several areas. Some dhtml features are ommited completely, it is not secure, and it's full of bugs.

Basically, use whatever browser you like. As time goes on, I expect Mozilla based browsers (mozilla / firefox) to improve. Internet explorer is not being actively developed at the moment (bug fixes only) as it is apparently going to be replaced in the next version of windows. However, as it already does practically everything you'd want, it doesn't really need any major development. At least it gives the others a chance to catch up / overtake

Iain
Old 01 July 2004, 08:19 PM
  #29  
stevencotton
Scooby Regular
 
stevencotton's Avatar
 
Join Date: Jan 2001
Location: behind twin turbos
Posts: 2,710
Likes: 0
Received 1 Like on 1 Post
Default

Sorry - did you have IE and secure in the same sentence? Yet another exploit for IE has emerged since the birth of this thread Secure it most definitely is not.

Steve
Old 01 July 2004, 08:39 PM
  #30  
Iain Young
Scooby Regular
 
Iain Young's Avatar
 
Join Date: Sep 1999
Location: Swindon, Wiltshire Xbox Gamertag: Gutgouger
Posts: 6,956
Likes: 0
Received 0 Likes on 0 Posts
Default

At least they fix the problems, which is more than you can say for mozilla / opera. There have been some shocking security problems in Netscape / Mozilla over the years....

No browser is secure, and even the most secure is only as good as the last update / hack. Have a good popup blocker, virus checker, firewall, don't visit dodgy websites, and you should be ok with any browser.

I'm not saying IE is better (in fact I prefer firefox), but I really get tired of the continual MS bashing when in fact the other browsers are just as bad (only in different ways).....


Quick Reply: Critical security flaw in Explorer (now there's a suprise)



All times are GMT +1. The time now is 10:31 PM.