December 14, 2012
Microsoft Confirms Internet Explorer Security Flaw that allows Hackers Track Mouse Moves
The alleged flaw, which security firm Spider.io says it discovered a few months ago, compromises the security of virtual keyboards and virtual keypads in all supported versions of the browser since IE6, the security firm reports.
"As long as the page with the exploitative advertiser's ad stays open -- even if you push the page to a background tab or, indeed, even if you minimize Internet Explorer -- your mouse cursor can be tracked across your entire display," the security firm said in a statement.
Even the security-conscious are at risk of having their cursor movements recorded, Spider.io warned. "An attacker can get access to your mouse movements simply by buying a display ad slot on any Web page you visit," the security firm warned, adding that any site from YouTube to The New York Times would be a possible attack vector due to ad exchange activity.
At least two display ad analytics companies are exploiting the suspected vulnerability (see video below demonstrating the issue) to see what people are looking at online, Spider.io said.
The security researcher said it informed Microsoft of the issue on October 1 but that the software giant doesn't appear to be in a hurry to patch the vulnerability.
"Whilst the Microsoft Security Research Center has acknowledged the vulnerability in Internet Explorer, they have also stated that there are no immediate plans to patch this vulnerability in existing versions of the browser," the firm said in a statement. "It is important for users of Internet Explorer to be made aware of this vulnerability and its implications."Microsoft appeared to downplay the issue, blaming competition between analytics companies.
"From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," Dean Hachamovitch, VP of Internet Explorer, said in a company blog post this afternoon.
"We are actively working to adjust this behavior in IE," he wrote, adding that there are similar capabilities in other browsers. He promised to update the blog when more information becomes available.
Categories:
Browser,
Internet Explorer,
Microsft,
Patch,
Security Flaw,
Spider.io
September 19, 2012
German Goverment Urges Everyone to Stop Using Internet Explorer
Following the recent bug that was discovered in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8 and Internet Explorer 9 which makes PC's vulnerable to attack by hackers, the German government advised the public on Tuesday to stop using the browser temporarily.
The security flaw, which affects hundreds of millions of Internet Explorer browser users around the globe, publicly surfaced over the weekend.
Microsoft had said on Monday that attackers can exploit the bug to infect the PC of somebody who visits a malicious website and then take control of the victim's computer.
The German government's Federal Office for Information Security, or BSI, said that it was aware was aware of targeted attacks and that all that was needed was to lure web surfers to a website where hackers had planted malicious software that exploited the bug in Internet Explorer to infect their PCs.
"A fast spreading of the code has to be feared," the German government said in its statement.
BSI advised all users of Internet Explorer to use an alternative browser until the manufacturer has released a security update.
Officials with Microsoft did not respond to a request for comment on the move by the German government.
The company late on Monday urged customers to install a piece of security software as an interim measure, buying it time to fix the bug and release a new, more secure version of Internet Explorer.
Microsoft did not say how long that will take, but several security researchers said they expect the update within a week.
The free security tool, which is known as the Enhanced Mitigation Experience Toolkit, or EMET, is available through an advisory on Microsoft's website: blogs.technet.com/b/msrc/
The EMET software must be downloaded, installed and then manually configured to protect computers from the newly discovered threat, according to the posting from Microsoft. The company also advised customers to adjust several Windows security settings to thwart potential attackers, but cautioned that doing so might impact the PC's usability.
Some security experts had said it would be too cumbersome for many PC users to implement the measures suggested by Microsoft. Instead they advised Windows users to temporarily switch from Internet Explorer to rival browsers such as Google Inc's Chrome, Mozilla's Firefox or Opera Software ASA's Opera.
Internet Explorer was the world's second-most widely used browser last month, with about 33 percent market share, according to StatCounter. It was close behind Chrome, which had 34 percent of the market.
The security flaw, which affects hundreds of millions of Internet Explorer browser users around the globe, publicly surfaced over the weekend.
Microsoft had said on Monday that attackers can exploit the bug to infect the PC of somebody who visits a malicious website and then take control of the victim's computer.
The German government's Federal Office for Information Security, or BSI, said that it was aware was aware of targeted attacks and that all that was needed was to lure web surfers to a website where hackers had planted malicious software that exploited the bug in Internet Explorer to infect their PCs.
"A fast spreading of the code has to be feared," the German government said in its statement.
BSI advised all users of Internet Explorer to use an alternative browser until the manufacturer has released a security update.
Officials with Microsoft did not respond to a request for comment on the move by the German government.
The company late on Monday urged customers to install a piece of security software as an interim measure, buying it time to fix the bug and release a new, more secure version of Internet Explorer.
Microsoft did not say how long that will take, but several security researchers said they expect the update within a week.
The free security tool, which is known as the Enhanced Mitigation Experience Toolkit, or EMET, is available through an advisory on Microsoft's website: blogs.technet.com/b/msrc/
The EMET software must be downloaded, installed and then manually configured to protect computers from the newly discovered threat, according to the posting from Microsoft. The company also advised customers to adjust several Windows security settings to thwart potential attackers, but cautioned that doing so might impact the PC's usability.
Some security experts had said it would be too cumbersome for many PC users to implement the measures suggested by Microsoft. Instead they advised Windows users to temporarily switch from Internet Explorer to rival browsers such as Google Inc's Chrome, Mozilla's Firefox or Opera Software ASA's Opera.
Internet Explorer was the world's second-most widely used browser last month, with about 33 percent market share, according to StatCounter. It was close behind Chrome, which had 34 percent of the market.
July 2, 2011
Clipboard Hacking: How it's done and how to Prevent It
This is one of the most popular things we do on the internet with our keyboard. "Ctrl+C". We copy data (i.e. email address, passwords, ssn, credit cards etc.) here and there and paste to wherever we want to reuse it. But do you realize that the data you copied are stored in what is called a clipboard temporarily and is accessible to anyone and can be stolen when you visit web sites using a combination of Javascripts and ASP (or PHP, or CGI) to write your data to a dabase on another server.
You might be wondering, how on earth is that possible. Its true and possible and we're going to explain how and how to prevent it from now happening. Just read on and i just hope you haven't copied a credit card number recently.
The Clipboard hack is done by the following Source Code:
Yes, with this simple script any website has the potential of stealing your sensitive information to their database.
Now the good news is this vulnerability can only be found on Internet Explorer and to avoid this clipboard hack problem IE users follow this simple steps.
Go to Internet Options -> Security
Press Custom Level
In the security settings, select disable under Allow paste operation via script.
Advise: I can't say you should stop using IE, though i don't use it but to save yourself from being a victim of this flaw don't use it. PERIOD.
Categories:
Hacking Tricks,
How-tos,
IE Bug,
Internet Explorer
Subscribe to:
Posts (Atom)