• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

FREE Non-MS Patch for fake URL in the address and status bars.

The test your browser option on the link is rather freaky...if this can be trusted (anyone have any feedbacK?) then I think this is good to have...
 
Originally posted by: jester79
read this before trying the patch
Click to expand...


Interesting..

SO both counts are true..
Install the patch to fix this issue (at least I hope it fixed it. didnt get a chance to test)
then I scrolled down and read the posting about the register...

so I sez, Damn! and then I ran Ad-aware (free) and it found 2 registry settings exactly as pointed out by the register.. I removed it..

Why not install the patch and remove the spyware? Any issues with that?

UPDATE: So I just checked it. THE PATCH Definately WORKS and gives an invalid page now using the 'spoof' -whereas before the patch, I could use the fake address and it pulls up the website.. Install Patch and remove using Ad-aware!
 
Originally posted by: MYKnyte
Originally posted by: jester79
read this before trying the patch
Click to expand...


Interesting..

SO both counts are true..
Install the patch to fix this issue (at least I hope it fixed it. didnt get a chance to test)
then I scrolled down and read the posting about the register...

so I sez, Damn! and then I ran Ad-aware (free) and it found 2 registry settings exactly as pointed out by the register.. I removed it..

Why not install the patch and remove the spyware? Any issues with that?

UPDATE: So I just checked it. THE PATCH Definately WORKS and gives an invalid page now using the 'spoof' -whereas before the patch, I could use the fake address and it pulls up the website.. Install Patch and remove using Ad-aware!
Click to expand...


Good info thanks. I was hoping someone else here would do before I tried it out.
 
The source is there, you shouldn't need adaware to fix that problem. And it doesn't look like adaware will fix the other problems in the patch...
 
Originally posted by: n0cmonkey
The source is there, you shouldn't need adaware to fix that problem. And it doesn't look like adaware will fix the other problems in the patch...
Click to expand...

What other problems? 🙁
 
Originally posted by: Ichinisan
If Microsoft has a knowledge base article for the issue, then they surely have a patch for it.
Click to expand...

To the best of my knowledge, Microsoft has not yet issued a patch
 
Originally posted by: DannyBoy
Originally posted by: n0cmonkey
The source is there, you shouldn't need adaware to fix that problem. And it doesn't look like adaware will fix the other problems in the patch...
Click to expand...

What other problems? 🙁
Click to expand...

Read the /. article linked above.
 
I've been spoofing URLs for (REVERSE!) TubG!rl pranks. If I knew this wasn't highly publicized, I would have done so back in August! I've used that login syntax for FTP access within IE hundreds of times. Daily in fact. Back in August of 2003, I got a yet another phish email (Like I do many times a week), only this time the URL in statusbar DID say www.ebay.com It was followed by a colon and extended authentication data (ie, a really long password) which pushed the real URL off the status bar. In other words, it was a half-assed way to hide the actual URL. Even so, at first and even slightly curious glances, it appears to simply be another complicated eBay URL. The colon told me immediately what was up though, because I know the syntax:
protocol://login😛assword@subdomain.domainname.topleveldomain😛ortnumber

Sure enough, it was some strange domain with a spoof site. Ever since then, I've combined the ALT+0160 pseudo-space trick to create a really long username disguised as a URL and fully qualified domain name (No colon or password required to tip-off users). With the average user using IE @ 1024x768, it's rather easy to spoof with this syntax without the %01%00 trick. It is not a browser vulnerability, but a simple oversight during the creation of the protocol syntax (Why can't the login and authentication information follow the URL instead of preceed it?). As such, other browsers will remain compatible with this syntax once Microsoft updates IE. It's not like status bars are going to display the link any differently :roll; This means you "Use Firebird" cronies better shut up... I already saw some of this in the thread. I know there is one other browser which is already aware of the scam and says something to the effect of "Your browser is actually going to this domain" but it certainly isn't Firebird.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top