Read more of this story at Slashdot.
Feeds
31246 items (26733 unread) in 5 feeds
OpenSource
(5366 unread)
-
SourceForge.net: Front page news
(802 unread)
-
Slashdot: IT (4564 unread)
Security
(9864 unread)
-
Digg / Security (9864 unread)
Linux
(11503 unread)
-
-
Slashdot: Linux (1582 unread)
30 items tagged "msie"
Slashdot: IT
-
Microsoft Upgrading Windows Users To Latest Version of MSIE
Posted: December 15th, 2011, 7:40pm CET by timothy
Tags: msie
helix2301 writes "Microsoft will be upgrading all Windows XP, Vista and 7 users to the latest IE silently. They are doing this because they have found a large number of non-patched systems. Microsoft pointed out that Chrome and Firefox do this regularly. They will start with Australia and Brazil in January, then go world-wide after they have assured there are no issues." -
IE 9 Beats Other Browsers at Blocking Malicious Content
Posted: August 16th, 2011, 10:33pm CEST by Unknown Lamer
Tags: msie
Orome1 writes with an article in Net Security. From the article: "Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks aimed at making the user download Web-based malware. This claim was made by NSS Labs in the recently released results (PDF) of a test conducted globally from May 27 through June 10 of the current year, which saw five of the most popular Web browsers pitted against each other. Windows Internet Explorer 9, Google Chrome 12, Mozilla Firefox 4, Apple Safari 5, and Opera 11 were tested with 1,188 malicious URLs — links that lead to a download that delivers a malicious payload or to a website hosting malware links."Read more of this story at Slashdot.
-
New IE Zero Day
Posted: December 23rd, 2010, 6:54pm CET by CmdrTaco
Tags: msie
RebootKid writes "Microsoft has released a notice about a new zero day attack against Internet Explorer. Guess it's going to be more a 'Script Kiddie Christmas,' less of a 'White Christmas.' 'Ok, fess up — who asked for an IE 0 day for Christmas? I'm guessing Santa got his lumps of coal mixed up with a bag of exploits. This exploit has been discussed over the last day or so on full disclosure and a number of other sites. Metasploit already has a module available for it (just search for CSS & IE). Microsoft has put out an advisory 2488013 regarding the issue which manifests itself when a specially crafted web page is used and could result in remote code execution on the client.'"Read more of this story at Slashdot.
-
Researchers Bypass IE Protected Mode
Posted: December 4th, 2010, 12:16am CET by Soulskill
Tags: msie
Trailrunner7 writes "A new paper from researchers at Verizon Business identifies a method through which an attacker can bypass Internet Explorer Protected Mode and gain elevated privileges once he's successfully exploited a bug on the system. Protected Mode in Internet Explorer is one of a handful of key security mechanisms that Microsoft has added to Windows in the last few years. It is often described as a sandbox, in that it is designed to prevent exploitation of a vulnerability in the browser from leading to more persistent compromise of the underlying system. In their research, the Verizon Business team found a method that, when combined with an existing memory-corruption vulnerability in the browser, enables an attacker to bypass Protected Mode and elevate his privileges on the compromised machine (PDF). The technique enables the attacker to move from a relatively un-privileged level to one with higher privileges, giving him complete access to the logged-in user's account."Read more of this story at Slashdot.
-
IE Flaw Exploit In Hacker Kit 'Raises the Stakes'
Posted: November 8th, 2010, 11:09pm CET by Soulskill
Tags: msie
CWmike writes "Roger Thompson, chief research officer of AVG Technologies, said Sunday that an exploit for the newest IE flaw had been added to the Eleonore crimeware attack kit. 'This raises the stakes considerably, as it means that anyone can buy the kit for a few hundred bucks, and they have a working zero-day,' Thompson said on his company's blog. Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update. Microsoft will deliver three security updates Nov. 9, but won't fix the IE bug then."Read more of this story at Slashdot.
-
Nasty Data-Stealing Bug Haunts Internet Explorer 8
Posted: September 4th, 2010, 11:48pm CEST by Soulskill
Tags: msie
Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8."Read more of this story at Slashdot.
-
IE9 Flaunts Hardware-Accelerated Canvas
Posted: July 3rd, 2010, 8:01am CEST by timothy
Tags: msie
An anonymous reader writes "Over on the IE blog they have a rundown of IE9's hardware accelerated support for the canvas element. They write, 'With the recent release of the latest IE9 platform preview, we talked about how we're rebuilding the browser to use the power of your whole PC to browse the web, and to unlock a new class of HTML5 applications. One area that developers are especially excited about is the potential of HTML5 canvas. Like all of the graphics in IE9, canvas is hardware accelerated through Windows and the GPU. In this blog post we discuss some of the details behind canvas and the kinds of things developers can build.'"Read more of this story at Slashdot.
-
New Tool Reveals Internet Passwords
Posted: July 1st, 2010, 3:18pm CEST by CmdrTaco
Tags: msie
wiredmikey writes "A new password cracking tool released today instantly reveals cached passwords to websites in Microsoft Internet Explorer, and mailbox and identity passwords in all versions of Microsoft Outlook Express, Outlook, Windows Mail, and Windows Live Mail."Read more of this story at Slashdot.
-
The Man At Microsoft Charged With Destroying IE6
Posted: May 28th, 2010, 12:17am CEST by timothy
Tags: msie
Barence writes "The man in charge of Internet Explorer has told PC Pro that he's been tasked with destroying IE6. Internet Explorer 6 continues to be the most used browser version in the world at the ripe old age of nine. IE6's position as the default browser in Windows XP means many companies still cling to the browser. 'Part of my job is to get IE6 share down to zero as soon as possible,' said Ryan Gavin, head of the Internet Explorer business group. Microsoft has also been giving further previews of Internet Explorer 9, with demonstrations showing two 720p HD videos running simultaneously on a netbook, thanks to IE9's GPU-accelerated graphics."Read more of this story at Slashdot.
-
IE8's XSS Filter Exposes Sites To XSS Attacks
Posted: April 20th, 2010, 7:22am CEST by kdawson
Tags: msie
Blue Taxes writes "The cross-site scripting filter that ships with Microsoft's Internet Explorer 8 browser can be abused by attackers to launch cross-site scripting attacks on websites and web pages that would otherwise be immune to this threat. The IE8 filter works by scanning outbound requests for strings that may be malicious. When such a string is detected, IE8 will dynamically generate a regular expression matching the outbound string. The browser then looks for the same pattern in responses from the server. If a match is made anywhere in the server's response, the browser assumes that a reflected XSS attack is being conducted and the browser will automatically alter the response so that the XSS attack cannot succeed. The researchers figured out a way to use IE8's altered response to conduct simple abuses and universal cross-site scripting attacks, which worked against sites that would not otherwise have been vulnerable to XSS." Here is the researchers' backgrounder (PDF) on the attack. Microsoft says that they have issued two patches that address the issue, but the researchers insist that holes remain. Update: 04/20 14:06 GMT by KD : Microsoft's Security Response Center has issued a statement on the vulnerability.Read more of this story at Slashdot.
-
Internet Explorer 9 Will Not Support Windows XP
Posted: March 20th, 2010, 12:40pm CET by timothy
Tags: msie
MojoKid writes "As it turns out, news this week is that the same features that made IE9's hardware-acceleration possible probably aren't compatible with Windows XP. Microsoft initially dodged giving a straight answer to the question of XP support but has since admitted that the new browser won't be XP-compatible when it launches. This has created a small tempest of protest from those users still using XP, but this is less of an arbitrary decision than some appear to think. It's literally impossible to port Windows Vista/Win 7-style hardware acceleration backwards to XP. Microsoft would have to either develop a workaround from scratch or create a CPU-driven 'software mode.'"Read more of this story at Slashdot.
-
IE 6 & 7 Unpatched Exploit Goes Wild
Posted: March 11th, 2010, 7:19pm CET by CmdrTaco
Tags: msie
Kolargol00 writes "Heise online reports the availability of an exploit (Google translation) for the yet-unpatched MSA-981374 affecting Internet Explorer 6 and 7. It has already been spotted in the wild by McAfee and integrated into the Metasploit Framework."Read more of this story at Slashdot.
-
IE Flaw Gives Hackers Access To User Files
Posted: February 4th, 2010, 8:44pm CET by timothy
Tags: msie
snydeq writes "Microsoft warned that a flaw in IE gives attackers access to files stored on a PC under certain conditions. 'Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location,' Microsoft said in a security advisory. The vulnerability requires that an attacker knows the name of the file they want to access, according to the company."Read more of this story at Slashdot.
-
UK Gov't Says "No Evidence" IE Is Less Secure
Posted: January 31st, 2010, 12:00pm CET by timothy
Tags: msie
aliebrah writes "Lord Avebury tabled a parliamentary question in the UK regarding the security of Internet Explorer and whether the UK government would reconsider its use. He got an answer from the UK Home Office that's unlikely to please most Slashdot readers. The UK government contends that 'there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure.'"Read more of this story at Slashdot.
-
Widespread Attacks Exploit Newly-Patched IE Bug
Posted: January 23rd, 2010, 4:01pm CET by Soulskill
Tags: msie
itwbennett writes "The first widespread attack to leverage the Internet Explorer flaw that Microsoft patched in an emergency update Thursday morning has surfaced. By midday Thursday Symantec had spotted hundreds of Web sites that hosted the attack code. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec. Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name." Relatedly, reader N!NJA was among several to point out that Microsoft has apparently been aware of this flaw since September.Read more of this story at Slashdot.
-
Microsoft Patches "Google Hack" Flaw In IE
Posted: January 21st, 2010, 10:40pm CET by timothy
Tags: msie
An anonymous reader writes "As expected, Microsoft has issued an out-of-band security patch to address a remote code execution hole in Internet Explorer that was used in the recent Chinese attacks disclosed by Google. Ars Technica has all the download links you need."Read more of this story at Slashdot.
-
Microsoft To Ship Emergency IE Patch
Posted: January 19th, 2010, 9:26pm CET by kdawson
Tags: msie
Grotendo writes "Microsoft plans to release an emergency patch for Internet Explorer very soon to counter targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser. The out-of-band update will be released once the company is satisfied that it has been properly tested against all affected versions of Windows. This could happen as early as this weekend." Microsoft has downplayed the seriousness of the IE zero-day, and insisted that it affects only IE6 even as security researchers close in on exploits for IE7 and IE8. Microsoft has had no comment about the firestorm that Google unleashed by directly accusing the Chinese of cyber espionage. ShadowServer has up a sobering post on the massive extent of the problem of "groups that can be referred to as the Advanced Persistent Threat."Read more of this story at Slashdot.
-
Microsoft Says Upgrade To IE8, Even Though It's Vulnerable
Posted: January 18th, 2010, 3:33pm CET by CmdrTaco
Tags: msie
Barence writes "Microsoft has issued a statement urging people to upgrade their browser to IE8, after the zero-day exploit that was used to attack companies such as Google went public. According to Microsoft's security advisory: 'the vulnerability exists as an invalid pointer reference within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.' But, although IE6 has been the source of the attacks until now, Microsoft's advisory admits that both IE7 and IE8 are vulnerable to the same flaw, even on Windows 7."Read more of this story at Slashdot.
-
IE 0-Day Flaw Used In Chinese Attack
Posted: January 15th, 2010, 1:29am CET by timothy
Tags: msie
bheer writes "A zero-day attack on IE was used to carry out the cyber attack on Google and others that's been getting so much ink recently, reports The Register, quoting McAfee's CTO. While the web (and security) community has pointed out the problems with IE's many security flaws (and its sluggish update cycle) in the past, IE shows no sign of vanishing from the corporate landscape."Read more of this story at Slashdot.
-
Major IE8 Flaw Makes "Safe" Sites Unsafe
Posted: November 24th, 2009, 11:32pm CET by kdawson
Tags: msie
After this weekend's report of a dangerous flaw in IE (which Microsoft confirmed today), intrudere points out an exclusive report in The Register on a new hole in IE8 that could allow an attacker to pull off cross-site scripting attacks on Web sites that ought, by rights, to be safe from XSS. This is according to two anonymous sources, who told El Reg that Microsoft had been notified of the vulnerability a few months ago.Read more of this story at Slashdot.
-
New Attack Fells Internet Explorer
Posted: November 22nd, 2009, 4:33pm CET by Soulskill
Tags: msie
alphadogg writes "Attack code has been identified that could be used to break into a PC running older versions of Microsoft's Internet Explorer browser. The code was posted Friday to the Bugtraq mailing list by an unidentified hacker. According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."Read more of this story at Slashdot.
-
MS Finds Security Flaw In Google Chrome Frame
Posted: November 20th, 2009, 11:40am CET by timothy
Tags: msie
Christmas Shopping writes with this excerpt from Kaspersky Labs' threatpost: "Back in September, when Google launched the Google Chome Frame plug-in for Internet Explorer users, Microsoft immediately warned that the move would increase the attack surface and make IE users less secure. Now comes word that a security researcher in the Microsoft Vulnerability Research (MSVR) has discovered a 'high risk' security vulnerability that could allow an attacker to bypass cross-origin protections." "Google has hurried out a patch," he adds.Read more of this story at Slashdot.
-
Microsoft Launches New "Get the Facts" Campaign
Posted: June 19th, 2009, 2:00pm CEST by timothy
Tags: msie
ko9 writes that Microsoft has re-launched its "'Get the facts' campaign, in an attempt to promote Internet Explorer 8. It contains a chart that compares IE8 to Firefox and Chrome. Needless to say, IE8 comes out as the clear winner, with MS suggesting it is the only browser to provide features like 'privacy,' 'security,' 'reliability.' It even claims to have Firefox beat in 'customizability.'"Read more of this story at Slashdot.
-
Internet Explorer 6 Will Not Die
Posted: June 2nd, 2009, 4:00pm CEST by timothy
Tags: msie
caffeinejolt writes "Despite all the hype surrounding new browsers being released pushing the limits of what can be done on the Web, Firefox 3 has only this past month overtaken IE6. Furthermore, if you take the previous report and snap on the Corporate America filter, IE6 rules the roost and shows no signs of leaving anytime soon. Sorry web developers, for those of you who thought the ugly hacks would soon be over, it appears they will linger on for quite a bit — especially if you develop for business sites."Read more of this story at Slashdot.
-
IE8 Update Forces IE As Default Browser
Posted: May 1st, 2009, 2:07pm CEST by timothy
Tags: msie
We discussed Microsoft making IE8 a critical update a while back; but then the indication was that the update gave users a chance to choose whether or not to install it. Now I Don't Believe in Imaginary Property writes in with word that the update not only does not ask, but it makes IE the default browser. "Microsoft has a new tactic in the browser wars. They're having the 'critical' IE8 update make IE the default browser without asking. Yes, you can change it back, but it doesn't ask you if you want IE8 or if you want it as the default browser, it makes the decisions for you. Opera might have a few more complaints to make to the EU antitrust board after this, but Microsoft will probably be able to drag out the proceedings for years, only to end up paying a small fine. If you have anyone you've set up with a more secure alternative browser, you might want to help check their settings after this."Read more of this story at Slashdot.
-
IE8 Released As Critical Update For XP
Posted: April 29th, 2009, 5:34am CEST by kdawson
Tags: msie
Binestar was one of several readers writing in to note that Microsoft is listing IE8 as a critical update to Windows XP. CNet reported a couple of weeks back that Microsoft would be rolling our IE8 to users in a gradual fashion, and requiring an opt-in before installing it. Opinion has been split as to whether IE8 is worth installing or not. Binestar notes delicately, "For those not interested in upgrading to IE8 at this time, the MSDN released information back in January on how to keep IE8 off your machine."Read more of this story at Slashdot.
-
Microsoft Rushes Internet Explorer Patch
Posted: December 18th, 2008, 3:34pm CET by CmdrTaco
Tags: msie
drquoz writes "Last week, it was reported that a critical security flaw was found in Internet Explorer. On Tuesday, experts were advising users not to use IE until a patch could be released. On Wednesday, Microsoft released the patch. An interesting quote from the article: 'Kandek suggests that Microsoft is at a disadvantage in updating Internet Explorer because its browser doesn't have a built-in update mechanism like other browser makers. Mozilla, for instance, just released Firefox 3.05 to Firefox users through its auto-update system.'"Read more of this story at Slashdot.
-
Microsoft Blames Add-Ons For Browser Woes
Posted: November 21st, 2008, 9:58pm CET by timothy
Tags: msie
darthcamaro writes "Running IE and been hacked? Don't blame Microsoft — at least that's what their security types are now arguing. 'One of the things we've seen in the last two years is that attackers aren't even going after the browser itself anymore,' Eric Lawrence, Security Program Manager on Microsoft's Internet Explorer team, said. 'The browser is becoming a harder target and there are many more browsers. So attackers are targeting add-ons.' This kinda makes sense since whether you're running IE, Firefox, Safari or Chrome you could still be at risk if there is a vulnerability in Flash, PDF, QuickTime or another popular add-on. Or does it?"Read more of this story at Slashdot.
-
IE 8 To Include New Security Tools
Posted: July 5th, 2008, 12:44am CEST by ScuttleMonkey
Tags: msie
Trailrunner7 writes "Internet Explorer has been a security punching bag for years, and rightfully so. IE 6 was arguably the least secure browser of all time. But Microsoft has been trying to get their act together on security, and the new beta of IE 8, due in August, will have a slew of new security features, including protection against Type-1 cross-site scripting attacks, a better phishing filter and better security for ActiveX controls."Read more of this story at Slashdot.
-
Microsoft Pushes Devs With Wider IE8 Beta
Posted: June 1st, 2008, 5:08pm CEST by Soulskill
Tags: msie
An anonymous reader recommends a story about the upcoming beta 2 release of Internet Explorer 8. InternetNews expects that the standards-compliant default mode will push many developers to update their sites. We've previously discussed IE8's standards compliance and other features. Quoting: "Over the years of IE's dominance as the leading browser, designers regularly tweaked their sites to get the best possible accuracy in rendering pages in IE -- most recently, the current commercial release, IE7. Now those pages will need to be changed. Microsoft originally planned for IE8 to default to rendering similarly to IE7, while super standards mode would have been an option. The outcry from critics helped convince Microsoft officials to instead default to super standards. That, unfortunately, will mean work for site administrators."Read more of this story at Slashdot.