IE security holes spread spyware/adware

[dukdukgoos]

IE is becoming a menace. If you're tired of patching the "Security Hole of the Day":

Mozilla
Opera

 

[n0cmonkey]

I thought that was pretty obvious. With all of the known but unpatched holes in IE, I can't see why anyone would choose to use it.

 

[Sid59]

cough FIREFOX!

 

[EeyoreX]

And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products. Part of the "more secure" nature of these products is the lack of market-share.

I use IE because I patch, I avoid sites that are of questionable nature, do my best to protect my PC, I like it, and was unimpressed with the replacement browsers.

\Dan

 

[n0cmonkey]

Originally posted by: EeyoreX
And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products. Part of the "more secure" nature of these products is the lack of market-share.

I use IE because I patch, I avoid sites that are of questionable nature, do my best to protect my PC, I like it, and was unimpressed with the replacement browsers.

\Dan

That is 100% pure bunk and you know it. Stop spouting FUD.

 

[drag]

Originally posted by: EeyoreX
And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products. Part of the "more secure" nature of these products is the lack of market-share.

You just keep telling yourself that.

You know, of course, that some software just sucks. Popularity does not equal quality, and neither does Popular software have to be full of holes.

I use IE because I patch, I avoid sites that are of questionable nature, do my best to protect my PC, I like it, and was unimpressed with the replacement browsers.

My track record for spyware is 0. Haven't had any software unintentially installed on my computer for probably close to 3 years. If that's unimpressive, then by all means keep on using MS products.

But then again, when Firebird ends up being more popular then IE and a gigantic worm wipes out my computer, then you get to have the last laugh. Something to look forward to, I guess.

 

[n0cmonkey]

Originally posted by: dragBut then again, when Firebird ends up being more popular then IE and a gigantic worm wipes out my computer, then you get to have the last laugh. Something to look forward to, I guess.

bwahaha!

😀

 

[Schadenfroh]

repost

 

[dukdukgoos]

Originally posted by: Schadenfroh
repost

Uh, this is a different issue. Don't worry, IE has so many it's hard for anyone to keep track! 😀

 

[Gurck]

Are you still using it?

Lol, good god no!

 

[crazycarl]

u have to wonder, do the people who still use IE know there are other browsers out there?

 

[MechxWarrior]

Hmm. IE is perfect for me. Im no moron and know how to protect my computer. I wont get adware using IE 😛

I dont mind having windows patch itself nightly without me even noticing so why is it a bother?

I hate the bloated looks of all other programs. IE can be simple and sleek, thats why I use it.

 

[1sikbITCH]

Enlighten me here. It seems to me, that I had read that a major security hole in IE comes from MS Java. I also seem to remember reading that because of court rulings, MS can't fix it because it would unfairly block other developers from using their products with IE? I'm guessing "other developers" = Sun Microsystems.

Don't know where I read that, and have no idea if it's actually true. Btw I switched to Firefox several months ago and find it to be just great except when dealing with Java applications. When I try to click on a button on a site that runs a Javascript, nothing ever happens. I end up having to use IE to do my online banking, which is scary 🙁

 

[clamum]

I've always used IE and liked it. Once in a while I'll run Spybot but other than that it's fine.

 

[Nothinman]

I dont mind having windows patch itself nightly without me even noticing so why is it a bother?

Because the patches don't come out right a way all the time? It could be weeks before MS fixes a problem that you could have already been exploited by and you might not even realize it.

Enlighten me here. It seems to me, that I had read that a major security hole in IE comes from MS Java. I also seem to remember reading that because of court rulings, MS can't fix it because it would unfairly block other developers from using their products with IE? I'm guessing "other developers" = Sun Microsystems.

Probably. MS isn't allowed to develop their JVM any more because Sun won a lawsuit against them for making their JVM non-standard. Now I believe MS will be putting the Sun JVM into XP SP2.

And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products

No the same problems won't occur because the internals of the browsers are totally different. But I have no doubts that as more people use them, more bugs will get reported security related or not. But the difference ist here's nightly builds of Mozilla that will have those fixed incorporated even if the latest release doesn't yet, something that will never happen with IE.

 

[gistech1978]

Originally posted by: crazycarl
u have to wonder, do the people who still use IE know there are other browsers out there?

yes.
i use IE.
i dont get spyware or adware and I never have.

 

[EeyoreX]

And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products. Part of the "more secure" nature of these products is the lack of market-share.

You just keep telling yourself that.

It's a fact. When you are the most popular you are the biggest target. Period. End of story. Bottom line.

I am in no way denying that IE, when run unpatched, does have security holes. I am responding to people who think that Firebird/Mozilla/Opera/etc are the perfect foolproof "we have NO security problems whatsoever" people. I still contend that if/when they are being used by over 90% of the computing population they will have problems too. You keep telling yourself they won't. You people can say I am spreading FUD. You are just peddling wishful thinking and hope. Until you can prove to me this won't happen, statistically and logically speaking, I am right.

You know, of course, that some software just sucks. Popularity does not equal quality, and neither does Popular software have to be full of holes.

No, popular software does not have to be full of holes. But sometimes it is. And when every hacker, virus writer, etc etc etc is targetting your software it is easy to exploit those holes. I have seen it posted a dozen times that Mozilla/Firebird/etc have holes too, but who wants to attack a small minority when you gain notirity and a reputation for nailing the biggest?

I use IE because I patch, I avoid sites that are of questionable nature, do my best to protect my PC, I like it, and was unimpressed with the replacement browsers.

My track record for spyware is 0. Haven't had any software unintentially installed on my computer for probably close to 3 years. If that's unimpressive, then by all means keep on using MS products.

Congratulations. Hoorah for you!!! Mine is too. I will continue to use IE until an alternate browser impresses me. And I do check just in case. Using AdAware and SpyBot.

But then again, when Firebird ends up being more popular then IE and a gigantic worm wipes out my computer, then you get to have the last laugh. Something to look forward to, I guess.

And now that IE is more popular than Firebird, when a gigantic worm wipes out my computer then you can have the first laugh. Something to look forward to, I guess.

\Dan

 

[EeyoreX]

No the same problems won't occur because the internals of the browsers are totally different. But I have no doubts that as more people use them, more bugs will get reported security related or not. But the difference ist here's nightly builds of Mozilla that will have those fixed incorporated even if the latest release doesn't yet, something that will never happen with IE.

Maybe I am missing something, but I don't see how it matters if the "internals" of the browsers are different. So? Now everyone just has to write the viruses, etc differently. I'm not sure how a nightly build will help. Not everyone is going to install their Mozilla browser nightly. And if they did that defeats the first insult of the post: "If you're tired of patching the 'Security Hole of the Day'". Seems to me installing a nightly build is the same thing as a patch of the day. I doubt nightly builds will happen forever with any software.

And the bottom line is that most all big worms/viruses that are spread by IE all have patches available before the viruses hit. The problem is only partly the browser. Another part of the problem is people who refuse to or don't know any better than to update. Another part is Microsoft's, lets just say, "not the best" method of making these patches known for people who don't know better.

I say again that I don't think IE is perfect. I know it has problems. That is why I patch and am careful. I think that there are many people who think or give the impression they think that the alternate browsers are the perfect solution to the problem, when they are not. Or that they do not even have the potential for the same problems IE has. At this point it won't have the same problems. When it has 90%+ of the market for several years, I still bet that they will.

\Dan

 

[drag]

Until you can prove to me this won't happen, statistically and logically speaking, I am right.

I guess your right. I can't prove a negative.

I can't prove that firefox will never start sucking so you win, I give up. IE is actually a realy good program.

Logic wins in the end.

😉

 

[EeyoreX]

Until you can prove to me this won't happen, statistically and logically speaking, I am right.

I guess your right. I can't prove a negative.

I can't prove that firefox will never start sucking so you win, I give up. IE is actually a realy good program.

Logic wins in the end.

😉

I'm not talking about sucking or not. I never said firefox sucks. I said I was not impressed. There is a difference. This has nothing to do with the "suckage" of one browser over another. My facts are sound and my thinking rational. Of course, you only chose to address a non-point in my posting. I don't use Firefox etc because I don't like them, not because they suck. Like I said, I just was not impressed. Why should I change to something I don't like when what I use serves my needs and I do it safely? If you want my opinion of suckage, currently all the browsers suck. Either because they are full of holes and are big targets or because I don't like them. I just happen to be most comfortable with, and find the suckage that is, IE to be to my linking more than the suckage that is other current offerings. Once the alternate browsers mature more I may like them more and switch. I never once claimed that IE was the almighty god of browsers. I post often in threads where people ask for help removing spy/adware that they have gotten, which states by implication, if nothing else, that I know full well that IE has problems. I, for one, am all for people using what they want. Be it IE or Firefox or whatever. I don't crusade against other browsers.

\Dan

 

[drag]

Originally posted by: EeyoreX

Until you can prove to me this won't happen, statistically and logically speaking, I am right.

I guess your right. I can't prove a negative.

I can't prove that firefox will never start sucking so you win, I give up. IE is actually a realy good program.

Logic wins in the end.

😉

I'm not talking about sucking or not. I never said firefox sucks. I said I was not impressed. There is a difference. This has nothing to do with the "suckage" of one browser over another. My facts are sound and my thinking rational. Of course, you only chose to address a non-point in my posting. I don't use Firefox etc because I don't like them, not because they suck. Like I said, I just was not impressed. Why should I change to something I don't like when what I use serves my needs and I do it safely? If you want my opinion of suckage, currently all the browsers suck. Either because they are full of holes and are big targets or because I don't like them. I just happen to be most comfortable with, and find the suckage that is, IE to be to my linking more than the suckage that is other current offerings. Once the alternate browsers mature more I may like them more and switch. I never once claimed that IE was the almighty god of browsers. I post often in threads where people ask for help removing spy/adware that they have gotten, which states by implication, if nothing else, that I know full well that IE has problems. I, for one, am all for people using what they want. Be it IE or Firefox or whatever. I don't crusade against other browsers.

\Dan

Sorry, I was going by my definition. Any browser that I have to be carefull about what web pages I visit, by my definition, "sucks".

I don't crusade for browsers either. But when I go home to visit my family and I have to clean Windows over and over and over again in a vain attempt to stop porn pop-ups from coming up when my little sister is using the computer does not make me a happy camper. Now my mom knows how to do it but she still has to waste her time messing with it.

Nor am I that happy when last night my roomate was trying to find the lotto numbers for the nebraska state lottery, she does a google search and clicks on "www.nebraskastatelotto.com" by mistake. And now when ever she visits www.google.com (but not www2.google.com) she gets weird results for searches and now every 3rd result down she gets adds for crappy anti-virus software.

And then I spent 3 hours running various tools trying to get rid of it. I ran AVG anti-virus software, found one "virus". I updated and ran Spybot, found several types of registery hacks. I updated and ran Adaware, it found a couple things.

And guess what?? IE is still getting f-cked up google results. Go figure.

Now since I am a nice guy I fix their computers, and install Firefox, WinXP (reinstalled Windows since Mandrake, when they bought a lexmark printer and found out that Lexmark doesn't support Linux.) on my roomates computers is being removed in favor of Debian. So now I don't waste my time so much, but I know it won't be the end of it.

So it's not so much a jihad against Microsoft or a irrational love for Firefox that causes me to be so cynical, it's just a deep bleeding hatred for IE. So forgive me, I've been wounded.

And don't worry, I dont' think anybody is inferior for using IE. If you can use IE comfortably and entire aviod all those bad things from happening to your computer, then your a better man then me, EeyoreX.

 

[CTho9305]

Originally posted by: dukdukgoos

Originally posted by: Schadenfroh
repost

Uh, this is a different issue. Don't worry, IE has so many it's hard for anyone to keep track! 😀

Uh, it's the same issue. I posted about two previously-unknown holes, and if you read the writeups, you'd see that they were being used to install a spyware toolbar. You posted about the same two previously-unknown holes, used to install the same spyware toolbar.

 

[Nothinman]

It's a fact. When you are the most popular you are the biggest target. Period. End of story. Bottom line.

Then why isn't apache's security history so abysmal? You would think running almost 70% of the websites on the Internet would make them a target.

Maybe I am missing something, but I don't see how it matters if the "internals" of the browsers are different. So? Now everyone just has to write the viruses, etc differently

Are you a programmer? The internals are what's being exploited, all of the 'IE exploits' are really MSHTML exploits that could affect OE, Outlook, MS Help viewer and anything else that uses MSHTML to render HTML. Imagine for a second if the IE team actually used C++ strings and checked buffer sizes before copying data around, 2/3 of their exploits would have never happened. I havn't personally examined the code but I'm sure someone has ran something like the Stanford checker over Gecko by now.

I'm not sure how a nightly build will help. Not everyone is going to install their Mozilla browser nightly. And if they did that defeats the first insult of the post: "If you're tired of patching the 'Security Hole of the Day'". Seems to me installing a nightly build is the same thing as a patch of the day. I doubt nightly builds will happen forever with any software.

Have you even worked in/near a development project? Nightly builds happen automatically no matter what so the QA team can test them, but if a bug fix is checked in one night you can be sure that the next nightly build has that fix and you can use it whether an official build is put out. It's not a perfect solution, but it's more than MS gives you.

And the bottom line is that most all big worms/viruses that are spread by IE all have patches available before the viruses hit.

And most drunk drivers survive car accidents, does that mean you shouldn't care about driving drunk?

Another part is Microsoft's, lets just say, "not the best" method of making these patches known for people who don't know better.

The bigger part is Microsoft's, lets just say, "screw code inspection, if it compiles consider it good enough".

 

[n0cmonkey]

Originally posted by: EeyoreX

And as soon as the "utopia" of everyone no longer using a Microsoft product comes about, the same problems will occur on these replacement products. Part of the "more secure" nature of these products is the lack of market-share.

You just keep telling yourself that.

It's a fact. When you are the most popular you are the biggest target. Period. End of story. Bottom line.

Most of the time. Sure.

I am in no way denying that IE, when run unpatched, does have security holes. I am responding to people who think that Firebird/Mozilla/Opera/etc are the perfect foolproof "we have NO security problems whatsoever" people. I still contend that if/when they are being used by over 90% of the computing population they will have problems too. You keep telling yourself they won't. You people can say I am spreading FUD. You are just peddling wishful thinking and hope. Until you can prove to me this won't happen, statistically and logically speaking, I am right.

Look at historical evidence.

 

[CTho9305]

Originally posted by: Nothinman

It's a fact. When you are the most popular you are the biggest target. Period. End of story. Bottom line.

Then why isn't apache's security history so abysmal? You would think running almost 70% of the websites on the Internet would make them a target.

Ah, but what percent are, say, apache on linux 2.4? on linux 2.2? on win32? on solaris? on other *nixes? A successful exploit would likely only run on just a subset of all apache servers out there.

The bigger part is Microsoft's, lets just say, "screw code inspection, if it compiles consider it good enough".

You know that for a fact?