'State-sponsored attackers' using IE zero-day to hijack GMail accounts

[Night Hawk]

'State-sponsored attackers' using IE zero-day to hijack GMail accounts

By Ryan Naraine

June 13, 2012, 9:36am PDT


Summary: Microsoft’s advisory speaks of “active attacks” and follows a separate note from Google that references the IE flaw “being actively exploited in the wild for targeted attacks.”


Microsoft and Google have separately warned about a new Internet Explorer zero-day being exploited to break into GMail accounts.


The browser flaw, which is currently unpatched, expose Windows users to remote code execution attacks with little or no user action (drive-by downloads if an IE users simply surfs to a rigged site).

see full report

 

[asteidl]

This is why I use Firefox.

 

[Night Hawk]

Do not kid yourself! When going to check the free to try version of a new program I clicked the link for an option and before the av program's web filtering could act the new window slammed some "Mission Impossible to Remove" type addon toolbar on the 64bit flavor of FireFox! WaterFox

Think you are 100% safe with any browser? Guess again! Start thinking "Internet Security" regardless of which browser(s) you use.

 

[vaidas3]

This is why I use Firefox.

Night hawk speaks true.
there is no browser that is 100% safe..

i have seen very nasty infections in firefox users computers..
and some of them still believed firefox is safe there is no way to get infected..

 

[lehnerus2000]

NoScript

You should run Firefox in conjunction with NoScript.

I can't remember the last time something got into my PC (in XP or W7).

 

[Night Hawk]

That's an addon for FF from https://addons.mozilla.org/en-US/firefox/addon/noscript/developers It goes on the 64bit flavor of the browser as well namely WaterFox.

Back in 2008 one article graded IE, FF, and Safari. The grades were: "Qualitative score: Firefox gets a D, Safari an F, and IE a D" Browser Security: IE vs. Safari vs. Firefox - Datamation

The golden rule is nothing is ever 100% safe!

 

[asteidl]

While I admit that no browser is perfect, I think I was just trying to say that security is a reason I use FF. (currently using 16.0a1 Nightly). I'd rather trust a global volunteer community. Which means that while I enjoy using Windows, given the opportunity, I'll do my work in a nix environment, and keep Windows for gaming.

Not trying to begin a debate here.

 

[Night Hawk]

At one time you could say going FF was the smart move since IE 6 was a security nightmare to begin with! It simply saw too many exploits to be usable! But with the delays in Vista being released IE 7 came along late which cleaned a number of those vulnerabilities seen with 6. IE 8 topped over 7 faster.

Unfortunately it doesn't take too long for malware writers to come out with new tricks at getting past any browser especially those that are popular! Malware writers love "popular" anything since that's their main targets! With the 64bit WaterFox on one site planted that toolbar on where even the WaterFox folder was removed before seeing another clean install of the browser only to see that same unwanted tool bar back! Once FF was removed along with WF a second time the folders for each were dumped to see a 3rd WaterFox install without the tool bar!

Despite having caught that with the 64bit version having an entirely separate folder to start with in the "C:\Program Files\" directory the bug was placed where? Right in the "C:\Program Files(x86)\Mozilla\FireFox\" folder very cleverly! It targeted the 32bit FF from the start! So is FF so much safer then IE or any other browser one could ask?

The answer to that is "NO!"! The old 2008 article says it all with all seeing failing grades! Despite all the improvements claimed to be seen with each newer version the best security is getting behind a good firewall with an effective web filtering as well as for FF anyways the "NoScript" addon available. That will act much like a firewall by having the options to allow certain or all on any site.

Another tool for both IE and FF is the "WOT" Web Of Trust addon. If you register you then have access to the parental controls available which can help weed out bad sites. But you will notice all these are additional layers not included with any particular browser to start with.

 

[lkgriffith]

Looks like one needs to have one computer specifically for web browsing and email and another one not connected to the network at all to get real work done. Any transfer between them must be performed on a third computer especially setup to deal with network issues and to deny access to the bad stuff. Even then, it is not 100% "safe" so that you can do any stupid thing without having any consequence. Ultimately, security is dependent upon the person in front of the computer doing stuff. That person must know what he is doing and the consequence of any of his actions. Then he must be willing to be responsible for the result.

People who don't know what they are doing and want to be able to do any random stupid thing and be protected from his stupidity deserves to get burned.

 

[bigcitycat]

The major problem with Explorer is that you can't selectively block Java script and flash. It's all or nothing. With Firefox and noscript I can block on a site by site, script by script basis. Java and flash are the areas where you are most susceptible to all of these exploits.

 

[Night Hawk]

Java and Adobe both have been undergoing some scrutiny lately over security flaws. I think lkgriffith summed it up quite well when illustrating one method for isolation of a host machine by adding in those protective layers by deploying the second and third machines. That still would only hold true to a certain extent however.

The more sophisticated the malware is often it will be found to be more cleverly hidden! If your system lacks effective detection processes a malware in the form of an exe file can simply be placed in a user account sub folder or elsewhere other then the Windows directory and go to work after a delayed period of time like creating new registry entries for either downloading other bugs or self replicating itself like an I-Worm type virus.

Some bugs will attempt to recode any files it can on a drive even personal files stored in a totally separate folder. Once you move files from one drive to the next or onto another system and open one... Zapped by bug! instead of seeing bug zapped by Bug Zapper like an effective malware remover.

Besides carelessness or lack of experience by many the lack of three effective system guardians to speak can easily result in seeing some form of something get on. 1)Malware detection and removal by security/av program 2)efffective web filtering to reveal bad sites and 3) "Common Sense"!

So often that last item sadly lacks! When the web filter on an internet security program especially one with web filtering options steers you away from some place "enter at own risk" when deciding to add that same site to the exceptions. Others(many novice users) will simply think to themselve "hey this looks interesting" click... whamo!

"Gee what happened? How do I get rid of this thing?" Either someone wasn't paying attention or simply lacked any security options available even free from 3rd party sources like the Web Of Trust addon for both IE and FF! as well as few other browsers. The Clam av Security Toolbar for IE while being another tool bar offers some degree of web filtering when your regular av program lacks it.

In IE the option to disable many things is present if you go over the various security settings for each of the four sections there. Internet, Local Intranet, Trusted sites, and Restricted sites. The advanced tab also allows you to enable or disable a good number of items as well as going through the Privacy and Content tabs as well. For many bugs are written on intent to slip past the default security settings in each browser regardless of which one it is.

 

[lehnerus2000]

It's a lot more painful than using NoScript though.

The server version security for IE is even worse.

 

[Night Hawk]

Nothing is ever meant to be easy! :roflmao: if that were the case you would never have to worry about anything.

The difference there however is not using any 3rd party addon in order to raise the security level in IE. With NoScript that's a 3rd party addon you have to go out and get if you know it's available that is.

 

[lehnerus2000]

Fair enough

The difference there however is not using any 3rd party addon in order to raise the security level in IE. With NoScript that's a 3rd party addon you have to go out and get if you know it's available that is.

Fair enough (I still think that NoScript is easier to use though).

It's still "all or nothing" in IE though.
I don't see how you can apply those setting to individual sites, instead of entire zones.

FF has a built-in "all or nothing" system too (Options > Content).

I'm not sure why Mozilla doesn't do a deal with Inform Action and include NoScript in the basic install.
It could be disabled and the welcome page could tell you how to turn it on.
Better documentation would be handy too.

 

[Night Hawk]

There are addons for IE you can get like the WOT site rate addon plus the Clam av Security toolbar which will flag bad sites when detecting malicious code. The problem however is not with IE or FF but seems to be widespread with all browsers not providing options for these types of filtering!

Your next smartest move of course is to get behind a good firewall with web filtering included as an option. That then deals with the unintended surprises when going to run a general search and stumbling into the "void of whatever"?!

And then we simply come back to the third option of "deploying common sense" as far as what is gained through experience. Unfortunately most novice users lack this type of intuitiveness and get stung plenty of times when tripping over a bee hive snare of some type!