Don't use Internet Explorer Say's Microsoft

[craig7501]

http://latestnews.virginmedia.com/news/tech/2008/12/16/warning_for_internet_explorer_users

Computer security experts are advising users of Microsoft's Internet Explorer to switch to another web browser until a major security flaw is fixed.

The problem, first revealed last week, allows criminals to hijack computers and steal passwords if the user visits an infected website.

As many as 10,000 sites have already been compromised to take advantage of the flaw, according to anti-virus software producer Trend Micro.

So far the websites, which are mostly Chinese, have been used to steal computer game passwords which can be sold on the black market.

But Trend Micro security researcher Paul Ferguson told the Associated Press there were major concerns that the problem could be exploited by "more financially motivated criminals for more serious mayhem".

Microsoft said it had so far only found attacks against version 7 of Internet Explorer, the world's most popular web browser, but warned that other versions were "potentially vulnerable".

In a security update issued on Monday, the computer giant said: "We are actively investigating the vulnerability that these attacks attempt to exploit.

"We will continue to monitor the threat and update this advisory if this situation changes."

Microsoft may fix the problem in its regular monthly security update or issue an emergency software patch.

[shezz]

Thanks for the tumbs up craig

[moonwitch]

I thought this link might be useful

http://www.snopes.com/computer/virus/security.asp

Just in case we all get fake emails telling us about a fixit patch

[CornishPixi]

I havent used IE since it locked me out of ebid about 2 weeks back.. And I dont miss it :) firefox is the dogs danglies lol

[JoPhangan]

i only use firefox soooo much better then internet explorer wish mozilla did operating systems then i could get rid of microsoft stuff forever not really a linux fan so stuck with xp for now lol

[Fossy]

I havent used IE since it locked me out of ebid about 2 weeks back.. And I dont miss it :) firefox is the dogs danglies lol


Fully agree about Firefox and if you cannot get certain sites to work in Firefox there is an IE emulation tab as an add in which seems to work well.

[jeweleffects]

http://latestnews.virginmedia.com/news/tech/2008/12/16/warning_for_internet_explorer_users

Computer security experts are advising users of Microsoft's Internet Explorer to switch to another web browser until a major security flaw is fixed.

The problem, first revealed last week, allows criminals to hijack computers and steal passwords if the user visits an infected website.

As many as 10,000 sites have already been compromised to take advantage of the flaw, according to anti-virus software producer Trend Micro.

So far the websites, which are mostly Chinese, have been used to steal computer game passwords which can be sold on the black market.

But Trend Micro security researcher Paul Ferguson told the Associated Press there were major concerns that the problem could be exploited by "more financially motivated criminals for more serious mayhem".

Microsoft said it had so far only found attacks against version 7 of Internet Explorer, the world's most popular web browser, but warned that other versions were "potentially vulnerable".

In a security update issued on Monday, the computer giant said: "We are actively investigating the vulnerability that these attacks attempt to exploit.

"We will continue to monitor the threat and update this advisory if this situation changes."

Microsoft may fix the problem in its regular monthly security update or issue an emergency software patch.

What else is new? Glad I'm not using IE

:):):)
~Jan~

[bykimbo]

Actually, Microsoft have said nothing of the sort. *Other* people are suggesting changing browsers because of the vulnerability, but Microsoft are urging people *not* to change.

[moonwitch]

Actually, Microsoft have said nothing of the sort. *Other* people are suggesting changing browsers because of the vulnerability, but Microsoft are urging people *not* to change.

What are Microsoft saying?

*runs off to find a link*

[bykimbo]

What are Microsoft saying?

*runs off to find a link*

Here's the relevant bit:

But Microsoft counselled against taking such action.
"I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.
He added: "We're trying to get this resolved as soon as possible.
"At present, this exploit only seems to affect 0.02% of internet sites," said Mr Curran. "In terms of vulnerability, it only seems to be affecting IE7 users at the moment, but could well encompass other versions in time."

The story's on the BBC news site (http://news.bbc.co.uk/1/hi/technology/7784908.stm).

[moonwitch]

http://news.cnet.com/8300-10805_3-75.html

don't know if this is more helpful:confused:

Next fix isn't due till January according to this article

[craig7501]

Microsoft has confirmed that it is not just Internet Explorer 7 that is vulnerable to a new zero-day attack.

IE 5 and 6 have been confirmed as also vulnerable to the flaw which, when properly exploited, can allow a hacker to gain complete control of a vulnerable system.

"At this time, we are aware only of limited attacks that attempt to use this vulnerability against IE 7," said the company in a security advisory.

"Our investigation of these attacks so far has verified that they are not successful against customers who have applied the workarounds listed in this advisory. Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability."

The flaw targets a component in IE7 that handles XML tags. When the page confirms that the user is running a vulnerable browser and operating system, a specially crafted tag is loaded.

"Any security vendor basing their detection rules on the publicly available exploits is not detecting attacks fully," said Carsten Eiram, chief security specialist at Secunia.

"Users should therefore not just browse around using IE thinking that they're safe. Setting the security level to 'high' for the 'internet' security zone will somewhat protect you. Combined with Microsoft's suggestions related to OLEDB32.DLL you should be able to keep your system to yourself."



http://uk.news.yahoo.com/16/20081215/ttc-internet-explorer-flaw-worse-than-th-6315470.html

[lofty100e]

Advising people to use a different browser is fine in theory, but not practicable. Some sites that I use will only recognise IE, they do not respond to Firefox.

[kengillam]

So it only affects 0.02% of websites, well how many is that then.... quite few given the squillions of webstes out there! :mad: It's about time Micksoft checked their code before releasing their next flashy interface and concentrated on the basics.

[jeweleffects]

If Firefox doesn't work for some, try using Google Chrome (http://www.google.com/chrome/index.html?hl=en&brand=CHMA&utm_campaign=en&utm_source=en-ha-na-us-bk&utm_medium=ha&utm_term=google%20chrome) - it's pretty good and quite fast.

~Jan~

[canuckbid]

It's really bad for sure. It's at 12000 plus websites now. They place s code in that gives them full access to your computer. Banking passwods, feebay, PP, etc., all of them. Our National news even has people stating that Microsoft has "suggested " people use a different browser until the breach is fixed. First time they said that I think. Here's s short list of a few others available.

List of Alternative Web Browsers


Major Browsers (http://www.alternativebrowseralliance.com/browsers.html#cross): Opera, Firefox, Safari
More Cross-Platform Browsers (http://www.alternativebrowseralliance.com/browsers.html#cross2): Mozilla and Flock
Windows Browsers (http://www.alternativebrowseralliance.com/browsers.html#windows): K-Meleon and Google Chrome
Macintosh Browsers (http://www.alternativebrowseralliance.com/browsers.html#mac): Camino, OmniWeb and iCab
Linux Browsers (http://www.alternativebrowseralliance.com/browsers.html#linux): Konqueror, Galeon and Epiphany
I already had google loaded, so it was only a matter of a few seconds switch over. :D

[SalusLibrorum]

I use Firefox as my main browser, if I need to identify as IE then I'll use Opera and tell it to identify as IE, problem solved.

Really no one ever has to use IE, I haven't used it for years.

I've not tried Google Chrome, I'm not sure I trust Google any more, they seem to be trying to take over the world and record everyone's movements so they can throw adverts at them, or is that too cynical?

[canuckbid]

Intel was way ahead of them. They stole the world a long time ago. In the end they all run on their code. :D

[bikebitsnbobs]

I like Firefox. Lots of useful security/privacy Add-Ons; No Script, Adblock etc, very handy. Reckon it has always beat IE hands down for security.

[Fossy]

If I find Firefox will not display a site properly, I use the IE Tab emulator for Firefox. Its worked for me in the past.

https://addons.mozilla.org/en-US/firefox/search?q=ie&cat=all

[bikebitsnbobs]

Advising people to use a different browser is fine in theory, but not practicable. Some sites that I use will only recognise IE, they do not respond to Firefox.

You may need to spend just a little time setting it up, for example add-ons like no script will block certain pages unless you configure the browser to allow them. It is an add-on though so can be easily turned off if you don't like or want the extra security. Once set up though there should be no problems with not being able to view or navigate any websites. I don't have any problems with sites not working when using Firefox at all, but it did take me a little while experimenting to get it working how I wanted it. Now works like a charm and poos on IE for security.

[ChameleonSystems]

<apple hat>What is this microshaft Internet exploder?

Dun't understand... surely everyone has Safari! </apple hat>

Wonder what the dark side has to say since they been promoting we use microshaft Internet poo, in the interests of safety.... What a load of rubbish. More like feepay has been paid by the evil empire to force peeps to use their browser. Same with poopal.

[lofty100e]

Thanks for the helpfull advice folks, I will assess it tomorrow.

Chameleon: What would you expect? Dodgy website, dodgy payment systems so a dodgy browser fits in nicely.

[partsanthings]

Want to dump microsoft take a look at Unbuntu Linux www.ubuntu.com I've got a couple of my computer challenged people using it.

I've been using FF for years now. I find fewer and fewer sites that won't work with FF. When I do if it's a site that I really want/need to use I will email them explaining that I don't have a windows computer so there isn't a way for me to use IE. Sometimes I get a decent reply sometimes not. Next step is to try Opera and see if it will work. Now that there is FF3 I can't remeber any sites I am not able to use. One thing with Linux I have many options for a browser.

I just finished coding a website and it looked fine in all the browsers that I had access to except IE for it I had to add some special CSS code to make it work. Wonder who is complying with standards.


i only use firefox soooo much better then internet explorer wish mozilla did operating systems then i could get rid of microsoft stuff forever not really a linux fan so stuck with xp for now lol

[Huddylion]

Firefox is sooooooooooooooooo much better :)

[kengillam]

The thing is whether you like it or not, 80% or at least that's the stats from my website use IE so having a site that caters for the majority seems logical to me, surely FF should adjust not the other way round.

[bykimbo]

I notice my Vista updates system has downloaded a security update for IE this morning. Gosh, I wonder why? :rolleyes: