Serious bug in fully patched Internet Explorer puts user credentials at risk

A vulnerability in fully patched versions of Internet Explorer allows attackers to steal login credentials and inject malicious content into users' browsing sessions. Microsoft officials said they're working on a fix for the bug, which works successfully on IE 11 running on both Windows 7 and 8.1.

The vulnerability is known as a universal cross-site scripting (XSS) bug. It allows attackers to bypass the same origin policy, a crucially important principle in Web application models that prevents one site from accessing or modifying browser cookies or other content set by any other site. A proof-of-concept exploit published in the past few days shows how websites can violate this rule when people use supported versions of Internet Explorer running the latest patches to visit maliciously crafted pages.

To demonstrate the attack, the demo injects the words "Hacked by Deusen" into the website of the Daily Mail. But it also could have stolen HTML-based data the news site, or any other website, stores on visitors' computers. That means it would be trivial for attackers to use it to steal authentication cookies many websites use to grant access to user accounts once a visitor has entered a user name and password. Once in possession of the cookie, an attacker could access the same restricted areas normally available only to the victim, including those with credit card data, browsing histories, and other confidential data. Phishers could also exploit the bug to trick people into divulging passwords for sensitive sites.

The exploit appears to use iframes to tamper with IE's support of the same origin policy. The exploit code looks like this:

function go()
{
w=window.frames[0];
w.setTimeout("alert(eval('x=top.frames[1];r=confirm(\\'Close this window after 3 seconds...\\');x.location=\\'javascript:%22%3Cscript%3Efunction%20a()%7Bw.document.body.innerHTML%3D%27%3Ca%20style%3Dfont-size%3A50px%3EHacked%20by%20Deusen%3C%2Fa%3E%27%3B%7D%20function%20o()%7Bw%3Dwindow.open(%27http%3A%2F%2Fwww.dailymail.co.uk%27%2C%27_blank%27%2C%27top%3D0%2C%20left%3D0%2C%20width%3D800%2C%20height%3D600%2C%20location%3Dyes%2C%20scrollbars%3Dyes%27)%3BsetTimeout(%27a()%27%2C7000)%3B%7D%3C%2Fscript%3E%3Ca%20href%3D%27javascript%3Ao()%3Bvoid(0)%3B%27%3EGo%3C%2Fa%3E%22\\';'))",1);
}
setTimeout("go()",1000);

A Microsoft spokesperson issued the following statement:

We are not aware of this vulnerability being actively exploited and are working on a security update. To exploit this, an adversary would first need to lure the user to a malicious website, often through phishing. SmartScreen, which is on by default in newer versions of Internet Explorer, helps protect against phishing websites. We continue to encourage customers to avoid opening links from untrusted sources and visiting untrusted sites, and to log out when leaving sites to help protect their information.
The statement is correct in pointing out that to succeed, an attacker would first have to lure a target to a malicious site. In an age of social networking and shortened links, that's not a difficult burden to meet. And while SmartScreen could be an effective remedy, it would take some time for it to be put in place. And even then, SmartScreen would work only against attacks that are spammed to large numbers of people. SmartScreen would likely do nothing to prevent targeted attacks.

Disable Windows Sidebar and Gadgets NOW on Vista and Windows 7. Microsoft warns of security risk

Users of Windows Vista and Windows 7 have been advised to completely disable their Windows Sidebar and Gadgets, in response to what appears to be a serious security risk.

The Windows Sidebar is a vertical bar that can appear at the side of your desktop, containing mini-programs (known as gadgets) that can provide a number of functions such as a clock, the latest news headlines, weather report and so forth.

A security advisory issued by Microsoft's security team advises that vulnerabilities exist that could allow malicious code to be executed via the Windows Sidebar when running insecure Gadgets.

The warning comes ahead of a talk scheduled for Black Hat later this month by Mickey Shkatov and Toby Kohlenberg. Shkatov and Kohlenberg's talk, entitled "We have you by the gadgets", threatens to expose various attack vectors against gadgets, how malicious gadgets can be created, and the flaws they have found in published gadgets.

"We will be talking about our research into creating malicious gadgets, misappropriating legitimate gadgets and the sorts of flaws we have found in published gadgets."

If the researchers have managed to find ways to exploit existing gadgets that's particularly worrying.
Clearly Microsoft is worried about the security researchers' findings, and has issued a "Fix It Tool" which will protect Windows 7 and Vista users by entirely disabling the Windows Sidebar and Gadgets functionality.
Yes, that's right. Microsoft hasn't issued a security patch to fix the vulnerability. They're suggesting you completely nuke your Windows Sidebar and Gadgets.

Which is bad news if you found those sidebar gadgets useful. You better find a new way to tell what time it is, or catch the latest from your favourite RSS feeds.

Sorry if it causes you any pain, but I would recommend you follow Microsoft's advice if you run Windows 7 or Vista and apply their "Fix It tool" as soon as possible. It may be a sledgehammer to crack a nut - but it's a nut that needs smashing, and fast.

Interestingly, Microsoft has dropped Gadgets from the upcoming Windows 8. In retrospect, that was probably a very good idea.

Safari And Internet Explorer, First To Fall In Pwn2Own

The Pwn2Own contest, reported earlier by SecurityProNews, has taken place this week and two web browsers have already fallen.According to a ComputerWorld report, Apple's Safari fell to a french security company, the hack only took five seconds to implement.

The team which hacked Safari was able to walk home with a $15,000 cash prize and the MacBook Air they performed the hack on. What makes the hack impressive is Apple released asecurity update for the browser which fixed 64 security flaws.

While the Safari hack was done quickly, many have been greatly impressed by the Internet Explorer exploit. Instead of a company, the IE8 hack was developed by a single person, Stephen Fewer. He's an independent researcher who caught the eye of Aaron Portnoy, one of the TippingPoint's team, the group who put the Pwn2Own contest together.

Fewer had to use a few vulnerabilities to successfully hack IE8 on Windows 7. Here's what Portnoy said of the hack, "The most impressive so far" he continues, "He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That's something we've not seen at Pwn2Own before."

While Safari and IE8 have been hacked, Chrome has remained safe. No one has attempted to hack the browser, so their $20,000 prize is safe. The purse was only available to those who hacked the browser on the first day of the content. If anyone is able to successfully hack the browser now or later on, they will receive $10,000 from Google and $10,000 more from TippingPoint.

Pwn2Own has two more days before all is said and done, which will see hackers make their attempts at Mozilla Firefox, and the four smartphone operating systems: Apple iOS, Google Android, Microsoft Windows 7, and RIM' Blackberry.

Pwn2Own Contest Pays Hackers To Exploit Firefox, Internet Explorer, And Google Chrome

Pwn2Own is a contest put together which pits hackers against the major web browsers. Their goal is to successfully exploit the browsers and find bugs which allow for these hacks. The hackers aren't just doing this to be nice either, there's a prize pool worth $125,000. Cash, laptops, and desktops will all be available to win.

The contest features all the major browsers (Firefox, Internet Explorer, Safari, and Chrome), and will be functioning on both Windows 7 PC's and Mac OS X machines. The contest is hosted by TippingPoint, a research organization who works to provide protection against system vulnerabilities.

There are a couple of new additions to the contest, both of which will pay prize money. First, there will be a mobile hacking event. This will pit researchers against the likes of Apple's iOS, Google Android, Microsoft's Windows 7 Phone, and RIM's Blackberry OS.

The news which is really drawing attention to the event is Google Chrome joining in on the action. Not only are they participating, but they're ponying up their own dough to award the hackers. $20,000 will go to the hacker who can find an exploit in Google Chrome first.

Google has been very confident in their belief that Chrome cannot be hacked. This is due to their using of a 'sandbox' anti-exploit defense. This type of defense isolates a program from other system processes, and requires hackers to take an additional step to truly perform a successful breach.

Only on the first day will Google be providing their $20,000 prize. This is due to the fact that on the first day only the browsers themselves will be available to the contestants. On the second and third day, they are allowed to utilize system bugs on the operating systems to perform their hacks. For the last two days Google will still provide a $10,000 award, which will be matched by Tipping Point. So no matter what day a hacker might successfully exploit Chrome, they'll still receive $20,000.

This is the contest's fifth running, and the award money has never been higher. The contest itself is about helping the browser developers better implement security strategies that keep malicious hackers from fulfilling their exploits.

Microsoft To Unveil Windows Phone 7 Devices In October

Jefferies & Co. expects Microsoft Corp. to announce the launch of Windows Phone 7 devices on Oct. 11 in New York City. The brokerage reiterated its "buy" rating on shares of the software giant with a price target of $33.

"Microsoft also has an event scheduled in London on Oct. 4, so the launch may even be as early as next week. New devices from at least five [device manufacturers] -- Asus, Dell, HTC, LG and Samsung -- are likely to be available first in Europe, and later in the United States. We expect the initial wave to support only GSM. CDMA versions might become available in early 2011," said Egbert.

More details here.

Windows 7 SP1 Beta released

Windows 7 SP1 Beta helps keep your PCs and servers on the latest support level, provides ongoing improvements to the Windows OS, by including previous updates delivered over Windows Update as well as continuing incremental updates to the Windows 7 platforms.

Windows 7 SP1 Beta will help you:

• Keep your PCs supported and up-to-date
• Get ongoing updates to the Windows 7 platform
• Easily deploy cumulative updates at a single time
• Meet your users' demands for greater business mobility
• Provide a comprehensive set of virtualization innovations
• Provide an easier Service Pack deployment model for better IT efficiency.

In order to download and install the Windows 7 SP1 Beta you must currently have a Release to Manufacturing (RTM) version of Windows 7 already installed. You can register for the download here.

Windows 7 Compatibility Checker turns out to be a Trojan

A deceptive "help" message invites recipients to check their PCs’ compatibility with Windows 7 by downloading and running an altered version of the Windows 7 Upgrade Advisor concealing a Trojan.

Cybercriminals are well known for their predilection to spot and bank on people’s interest in what’s hot in the e-world. Operating systems and their latest developments are classic honey pots and it is practically impossible to miss their potential as baits for illicit gains.

With Windows 7 reaching general retail availability on October 2009, it was just a matter of time before malware creators rose to the occasion, and exploited users ‘eagerness to install it on their PCs.

This kind of success stories cannot exclusively rely on sheer luck, so a little bit of planning is mandatory. Here’s how the plot line goes this time: a “disinterested helping hand” type of e-mail reaches Windows users’ inboxes and recommends that they download the Windows 7 Upgrade Advisor Setup. This piece of software supposedly allows them to see if their system resources could support the new OS. All they have to do is open the attached .zip file.

Instead of the promised compatibility checking tool, the zip file hides Trojan.Generic.3783603. This piece of malware contains malicious software which it drops and installs on the system. Frequently, it installs a backdoor which allows remote, clandestine access to the infected system. This backdoor may then be used to upload and install additional malicious or potentially unwanted software on the captured system.

The infection rates reflected by the BitDefender Real-Time Virus Reporting System indicates the beginning of a massive spreading of the Trojan. Although this phenomenon has just started, it seems that it’s just a matter of time before the cybercriminals control a huge number of systems. Infection rates are also expected to boom because of the effective social engineering ingredient of this mechanism, namely the reference to the popular Windows OS.

In order to stay safe, BitDefender recommends that you never open the attachments coming from unknown contacts and that you install and update a complete anti-malware software solution. To always stay on the safe side of things, make sure you download the software you need from the official vendor’s website.

Windows 7 vulnerable to most viruses

Windows 7 was touted as a big improvement on Vista, security aspect included.

The Sophos team wanted to test that assertion, so they installed a full release copy of the new OS on a previously cleaned computer, kept the default values for User Account Control (UAC) and didn't install any anti-virus software.

They then proceed to infect the machine with 10 unique samples of malware that SophosLabs received last. The result wasn't good for the users (although it technically is a good result for manufacturers of anti-malware software around the world): only 2 out of 10 failed to operate!

The UAC managed to block by itself only on sample, and that is definitely not good enough.

The conclusion? If you installed Windows 7, don't forget to use anti-virus software.

Windows 7 - Improve your experience with these 77 tips

Windows 7 is set to debut on October 22, 2009.

These 77 tips will enhance security, performance, and functionality for this new operating system:

http://technet.microsoft.com/en-us/magazine/2009.10.77windows.aspx

QUOTE: Windows 7 may be Microsoft’s most anticipated product ever. It builds on Windows Vista’s positives, and eliminates many of that OS’s negatives. It adds new functionality, too—all in a package that is less resource-hungry than its predecessor.

At a Glance:
■ Make Windows 7 faster
■ Get more done with Windows 7
■ The best Windows 7 shortcuts
■ Securing Windows 7