AT&T Tech Support 360
October 25, 2006 4:45 PM PDT
Spoofing bug found in IE 7
- Related Stories
-
Minor issues surface after IE 7 launch
October 19, 2006 -
Microsoft hopes 7 is lucky number for IE
October 18, 2006 -
Phishers hijack IM accounts
October 16, 2006 -
Phishers catch on to the Net's 'long tail'
September 12, 2006
IE 7, released last week, allows a Web site to display a pop-up that can contain a spoofed Web address, security monitoring company Secunia said Wednesday. An attacker could exploit this weakness to trick people into believing they are on a trusted Web site when in fact they are viewing a malicious page, Secunia said in an alert.
"This makes it possible to only display a part of the address bar, which may trick users into performing certain unintended actions," Secunia said. The company has created a demonstration that shows a Microsoft Web address in the pop up window, but displays content from Secunia.
The problem lies in the way Web addresses are displayed in the IE 7 address bar, a Microsoft representative said in an e-mailed statement. An attacker could exploit the issue by tricking a user to click on a specially formatted link, the representative said.
The pop-up will block the left part of the Web address, Microsoft said. "Clicking in the browser window or in the address bar and scrolling within it will display the full URL, however," the company said. In case of the Secunia example, the true Secunia URL is revealed.
An attack won't work if a Web site is known to be part of a phishing scam, Microsoft said. The IE 7 phishing shield will identify such sites and warn the user, it said. Microsoft is not aware of any attacks that actually use the reported vulnerability, the company said.
IE 7 is the first major update to Microsoft's ubiquitous Web browser in five years. Security was the No. 1 investment for the update, Microsoft has said. The phishing protection has been a major focus for Microsoft, shielding against malicious Web sites designed to trick users into handing over their personal information.
The spoofing issue, rated "less critical" by Secunia, appears to be the first genuine, publicly disclosed flaw in the new Microsoft browser. An earlier problem, disclosed a day after the IE 7 release, lies in Outlook Express, not IE 7, Microsoft has said.
Microsoft will continue to look into the problem and may provide a browser patch to fix it, the company said. In addition, Microsoft chided the anonymous discloser of the flaw. The software maker prefers that security issues be disclosed privately so it can repair them before they get publicly known.
See more CNET content tagged:
Microsoft Internet Explorer 7,
address bar,
Microsoft Internet Explorer,
phishing,
weakness
This isn't even really a security 'vulnerability', it's a problem with the browsers that extends to Firefox and Opera as well.
The software maker prefers that security issues be disclosed
privately so it can repair them before they get publicly known."
Security Issues: Publicly unknown (the users), privately WELL
known (the hackers). Those wanting to do harm to your
computer have their own underground information network
where as the users are left waiting like sitting ducks while
Microsoft gets around to releasing fixes in their own sweet time.
Keep those anonymous disclosers coming, it's the only way to
force Microsoft to live up to their obligations.
It happened to someone that posted his story about it here at news.com He clicked on a link for a media player that thought was being used by myspace.com but it was a trojan. It filled his machine with spyware and made his life a living hell. He was using firefox at the time and that didn't protect him.
In the end, it doesn't matter which browser you use if you still click on the link or run the program. Don't be fooled, think before you click!
http://secunia.com/result_22542/? http://www.microsoft.com/
Which is weird since it's using the IE engine, but I think it's the way Maxthon does tabbed browsing.
Look like it's playing with the edit box's word wrapping to show the second line.
Vista, the "Windows ME" of the NT code base. Mark my words.
- This time Secunia = BS
-
by Jamie_Foster
October 27, 2006 4:53 PM PDT
- This is issue which is no big deal for the following 3 reasons:
-
Reply to this comment
-
-
See all 39 Comments >>1. On the pop-up all you have to is cliack the dropdown list and the entire true URL appears, not just the bit the Hacker wants you to see.
2. IE7 contains a quality phishing filter.
3. Anyone who enters financial info on a random popup is asking to be get ripped off.
This is not a critical bug where the hacker can take over your PC. It is a social engineering exploit. Those who use common sense will be safe.
One more thing, google "CA Antivirus Microsoft" and you can get a free 12 month sub to CA Anti-virus. Also turn on automatic updates and use the windows firewall if using XP. Finally don't run dodgy software (ie Kazaa), don't visit dodgy websites (ie porn, gambling etc} and protect your email account.