Originally posted by: BFG10K
Why should it matter what Link or popup I should click on? Why is it that I have to be carefull?
I run a locked down firewalled box and I can only presume that you're doing the same. Therefore most of the problems the general user encounters won't affect us because said problems have nothing at all to do with the browser.
Case and point: MSBlaster. I'd bet 95% of people who were affected had also "tweaked" their firewall settings which left their boxes wide open.
The only thing I should worry about is first purposely downloading and then purposely running programs,
ActiveX essentially creates the ability to run browser-embedded programs so really it's no different to someone downloading and running an executable.
that and "forced" downloads of activeX componates from trusted websites is partially why ActiveX was one of the worst design features in the history of software. Anytime using IE, ActiveX should be completely disabled...
Look at java applets, for instance, it has a terrific security record. The first serious problem with Java that I've heard about was about a exploit that broke you out of the java sandbox stuff. (if you haven't done it, update your JAVA stuff)
how many exploits have you heard of from the Macromedia Flash plugin for instance?
With ActiveX it's almost impossible patch or keep up to date since many websites have their own ActiveX controls and they force certain versions into your browser, or something like that. Not entire sure how it works.
But besides ActiveX, there are definately something wrong with the browser, and there is something wrong with how executables and such are handled in Windows in general. It's just that everybody is so used to how it works, it's hard to see sometimes. I think.
One example of what I am talking about is this:
Why does how a file is worded make a difference on weither or not it's executable?
Like kool.exe, so if somebody emails you a attatchment with kool.exe and you double click on it, it runs...
What purpose does allowing e-mail attachments to be executable serve?
Of course you can avoid this by simply not clicking on a exe e-mail attatchment, but there is a lot to watch out for..
*.bat *.chm *.cmd *.com *.cpl *.crt *.dll *.exe *.hlp *.hta *.inf *.ins *.isp *.js *.jse *.msi *.msp *.nws *.ops *.ocx *.pcd *.pif *.prf *.reg *.scf *.scr *.sct *.shb *.shm *.shs *.url *.vb *.vbe *.vbs *.vbx *.vxd *.wsc *.wsf *.wsh
And I don't even know what half of those mean!
Of course, run e-mail scanners, don't open e-mails from untrusted people, disable html rendering and such for all your emails and so on and so
So obviously a user should avoid messing around with e-mail attatchments and double clicking on them... but why does the file name matter? Hell even due to exploits in IE, it's not even safe to open certain *.jpg file in outlook/outlook express.
Of course WinXP SP2 helped this out quite a bit by implimenting it's complex solution of zones and and all that. But what about W2k? What about Win9x users...
I guess Win9x should be dead, but W2k is still actively supported by MS, why not the Sp2 fixes in W2k?
Personally I just like having to flip a permissions bit to get executable files, rather then relying on file name. Helps cut down on user error.
oh... And have you heard about the new trojan that can install itself on a fully patched WinXP machine using SP2 by exploiting a work around in the local security zone and running a exploit on IE? Nice stuff that is.
Oh, and it runs from a *.html file. So I guess a executable bit isn't going to help there.. :/
Maybe, the HTML file only triggers a download of a *exe and a *dll file that then is executed and runs the actually thing that infects your computer.
Probably can be fixed by not running as a admin, I think. Does not being admin protect against breaks in local zone security protections?
Good thing that it has a low rate of infection and is non-destructive and is easy to remove. Of course I suppose somebody could have a modified version download a more destructive payload, but lets hope MS gets around to releasing a patch to fix the flaw before that happens.