German government warns against using MS Explorer

German government warns against using MS Explorer 17.01.2010. u 14:07 · pre 204 meseca #1

Citat:

The German government has warned web users to find an alternative browser to Internet Explorer to protect security.

The warning from the Federal Office for Information Security comes after Microsoft admitted IE was the weak link in recent attacks on Google's systems.

Microsoft rejected the warning, saying that the risk to users was low and that the browsers' increased security setting would prevent any serious risk.

http://news.bbc.co.uk/2/hi/technology/8463516.stm

Inace taj exploit za IE6 radi odlično, malo sam se igrao, i sve zivo moze da se radi sa tim :)

E da... jos kad bi managment velikih kompanija to primetio...

Potpis

Bolje ispasti glup nego iz aviona
http://www.mulaz.org/

Re: German government warns against using MS Explorer 17.01.2010. u 14:24 · pre 204 meseca #2

Ovo je malo preterano, i mnogi security eksperti se nece sloziti sa ovim.

Kao prvo, i Mozilla Firefox isto ima vuln-ove - imali su i 0day vulnove, samo sto je IE daleko veceg profila i u ovom konkretnom slucaju je bio "tool".

Kao drugo, IE bar ima integrisan sistem apdejta u sam OS, sto je jako bitno za velike mreze.

Nisam bas siguran da je puka zamena browsera jednostavan lek za sigurnost.

Mislim da je DALEKO veca opasnost koriscenje PDF formata - STA CE DOKUMENT FORMATU JAVASCRIPT?, takodje STA CE tom formatu intruzivni viewer koji se duboko integrise u sistem?

HTML5 bi trebao da zameni ovaj OPASNI format. Sa HTML5 je moguce embeddovati fontove, i iskreno se nadam da ce taj format oduzeti dobar deo PDF trzista. PDF treba da CRKNE.

Pre neki dan sam hteo da posaljem nesto preko Deutsche Post-a/DHL-a (ovde je to ista firma) - umesto da idem u postu, imaju neki online sistem koji ti omogucava da isprintas "markicu".

Najjace je kada izvrsis order, a onda ti on shibne neki "aktivni PDF" koga ne mozes da otvoris kako treba sa FoxIt-om (odstampa djubre)... Stvarno se mislim KOJI CE IM PROKLETI DJAVO tako nesto? Apsolutno nepotrebno, i takodje prisiljava korisnike da imaju bukvalno sigurnosnu bombu na svom sistemu.

Sramota.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 17.01.2010. u 14:37 · pre 204 meseca #3

PDF je i onako #fail (jos pogotovu one "drm-style zastite" koje sprecavaju copy-paste ili stampanje, i koje rade vise-manje samo na adobe-ovem readeru).

Mislim da je tu jos uvek veliki problem da velike kompanije, gde na svakog IT-evca dodje <n> managera i "ventilatora" (onih sto samo mesaju vazduh), ne vide potrebu ni po upgrejdu IE6->IE{7,8}, jer to kosta (man-hours), a cak i neki business software je toliko optimizovan na IE6, da ne radi na noviim verzijama IE-a (a naravno ni na 'alternativnim' browserima).

Ali dobro.... par klinaca... par script kiddy alata (cak i vnc server moze da se injecta i pokrene na target kompjuteru).... XX hiljada dolara stete.... pa ce neko da pogleda business 'logove', gde ce da vide da je IT department hteo to da popravi <m> puta, a nije dobio potvrde/para 'odozgo' (cak znam i za konkretnu firmu gde se upravo sad to dogadja hehe :)), i nesto ce da se popravi u tom svetu.

Potpis

Bolje ispasti glup nego iz aviona
http://www.mulaz.org/

Re: German government warns against using MS Explorer 18.01.2010. u 14:34 · pre 204 meseca #4

ej Dimkovicu, jel moze neki link/vest/bilo sta sto se tice posledica lose implementacije, loseg samog PDF-a ??

neki link gde se vidi kako je neko iskoristio slabosti PDF-a o kojima ti pricas

mislim PDF postoji cak i duze nego Windows95, imaju ga gotovi svi korisnici racunara (ne samo Windows korisnici vec i Linux i Mac) tako da mi je prosto neverovatno da za Windows postoji 1001 virus/rupa ili sta vec, a za PDF i za sve ove godine ni jedan ? plz daj neki link.

BTW nemoj samo ponovo linkove nalik onima u kojima se govori kako je Mac OS X busan a realno nemamo ni jedan virus.

Re: German government warns against using MS Explorer 18.01.2010. u 14:52 · pre 204 meseca #5

Na secuini su trenutno 4 higlighted advisoryja

jedan za flash, jedan za IE, jedan za open type font, i cetvrti:
http://secunia.com/advisories/37690/

Potpis

Bolje ispasti glup nego iz aviona
http://www.mulaz.org/

Re: German government warns against using MS Explorer 18.01.2010. u 15:02 · pre 204 meseca #6

Citat:

calimero
neki link gde se vidi kako je neko iskoristio slabosti PDF-a o kojima ti pricas

Ovaj... sta znas, mozda prosetas malo dalje od roughlydrafted, u realnost :) PDF je pun sigurnosnih propusta, a fakat da su omasovili onaj idiotski JavaScript u njemu definitivno ne pomaze. U toku proteklih 3 godine je vec bilo nekoliko >potvrdjenih< 0day vulnova u PDF formatu i nekoliko javnih explota.

http://secunia.com/advisories/37690/ - CRITICAL

http://www.adobe.com/support/security/advisories/apsa09-01.html

http://www.theregister.co.uk/2...dobe_reader_vuln_under_attack/

http://news.cnet.com/8301-1009_3-10168266-83.html

Citat:

Attackers are making the rounds and exploiting a critical security flaw in Adobe Reader 9 and Acrobat 9.

Earlier versions of the PDF-related software are also affected by the critical security flaw, which could cause the applications to crash and potentially let an attacker gain control of a person's computer, Adobe Systems warned Thursday.

Reports also surfaced that attackers have developed an exploit and are taking advantage of the flaw, the company said.

Adobe has yet to develop an update to address the vulnerability but noted it expects to have one ready for Adobe Reader 9 and Acrobat 9 by March 11. After that, the company expects to launch updates for the earlier versions of the software going back to Adobe Reader 7 and Acrobat 7.

http://securitylabs.websense.com/content/Blogs/3311.aspx

Citat:

Websense® Security Labs™ ThreatSeeker™ Network has been monitoring [ 1 2 3 ] the malicious use of the now widely known zero-day vulnerability (CVE-2009-0658) affecting Adobe Reader 8.x and 9.x since last week. Adobe has released a security bulletin APSA09-01 describing the vulnerability and has stated that it will have a fix out by March 11th. We have categorized the sites that we have found to be hosting this exploit.

This vulnerability is different than the one found at the end of last year (Exploit Action with PDF OpenAction) in Adobe PDF reader. This vulnerability allows the attacker to overwrite memory with executable shell code that uses "Heap Spray" technology in Javascript when parsing a specially crafted JBIG2Decode image object.

http://blogs.zdnet.com/security/?p=566

Citat:

Adobe confirms PDF backdoor, offers unsupported workaround

Adobe has fessed up to a dangerous code execution vulnerability affecting software programs installed on millions of Windows machines.

I tako dalje i tako blize :)

PDF je djubre. Sam format je mozda OK ali je njegova implementacija od strane Adobe-a BS.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 18.01.2010. u 15:08 · pre 204 meseca #7

http://www.infoworld.com/d/sec...-639?source=rss_infoworld_news

Citat:

Today, Joshua Talbot, security intelligence manager at Symantec, confirmed that the malicious PDF exploited the Adobe Reader and Acrobat vulnerability, but unlike Zdrnja, said it wasn't out of the ordinary. "It's not particularly novel or sophisticated," Talbot said.

Although the malicious PDF described by ISC has been seen in only limited numbers -- designed for high-profile targets, such as company executives or personnel with access to network passwords -- Symantec has monitored bigger attacks exploiting the PDF bug. One attack generated more than 34,000 detections on Symantec's global detection network, peaking on Dec. 31 before falling sharply.

http://blogs.zdnet.com/security/?p=3229

Citat:

Exploit posted for brand-new Adobe PDF zero-day

Proof-of-concept exploit code has been published for a new zero-day vulnerability haunting Adobe’s widely deployed PDF Reader software.

In a brief note posted to its PSIRT blog, Adobe confirmed it was investigating the issue, which affects Adobe Reader 9.1 and 8.1.4. “We are currently investigating, and will have an update once we get more information,” according to Adobe’s David Lenoe.

http://insecureweb.com/javascr...e-wild-with-real-exploit-code/

Citat:

Newish web-based PDF attack in the wild (with real exploit code)

The most interesting parts of the code are is in functions pdf, pdf2, and pdf3, which tries to detect whether you have the Adobe Acrobat plugin in your browser and tries to load the payload – a tainted PDF file in your browser, followed by a second. Other bits of the code try to run applications through Chrome.

Eto ti konkretni exploiti...

Ima ih jos ohoho :) Ali valjda je ovo dovoljno da se dokaze poenta.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 18.01.2010. u 18:08 · pre 204 meseca #8

Iako mi se ne svidja taj skrnelj sto rade sa java skriptom i aktivnim formama. Opet mogu da kazem da je pdf kao format bolji nego word, u krajnjem slucaju kad napravis pdf on svuda izgleda isto, dok word ne bude svuda identican. Mnogo puta ode prelom teksta tamo gde ne zelis jer ljudi nemaju identican font na oba racunara.

Potpis

http://speedy-order.com

Re: German government warns against using MS Explorer 18.01.2010. u 18:14 · pre 204 meseca #9

+ sto uvek mozete koristiti neki prost pdf reader a ne ono adobe-ovo mamutsko overbloated resenje :)

Potpis

make love - !war

Re: German government warns against using MS Explorer 18.01.2010. u 18:15 · pre 204 meseca #10

PDF jeste naravno bolji nego Word, za tu namenu (mislim... Word, za jednostavnu razmenu read-only WYSIWYG dokumenata... ahahah) - tu nema nikakve diskusije. Medjutim to ga ne cini dobrim :)

PDF je nekada davno bio OK format, kada je reader imao par MB i kada nije imao sigurnosne rupetine koje potencijalno ceo sistem cine kompromitovanim. Danas je PDF prerastao u monstruma sa aktivnim skript jezicima, DRM bshitarijama, readerom koji je preglomazan i koji "zove kucu" svake nedelje, i - da, pun je bagova kao ulicna macka.

I to ne BILO KAKVIH bagova, vec bagova koji omogucavaju root-ovanje racunara uz pomoc malformed PDF dokumenta, EJ!

Nadam se da ce HTML5 sa embeddovanim fontovima preoteti masivan market PDF-u za "glupe" jednostavne read-only dokumente. A takvi su ogromna vecina.

Otvoren standard, koga ce podrzavati svi internet browseri, na svim platformama... i nece ti trebati neki kilavi "plug-in" da bi ih video.

Inace, sta vam vredi gomila 3rd party PDF viewera kada se kompanije danas trude da zapakuju sto vise feature-a u PDF fajlove... kao sto rekoh, pre neki dan sam poludeo posto sam pukao 5.90 EUR za markicu koju nisam mogao da odstampam - jer Deutsche Post mnogo voli aktivni PDF, koji se vidi samo sa Acrobat Reader-om - koga zelim koliko i HIV virus.

HTML5 FTW!

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 18.01.2010. u 20:12 · pre 204 meseca #11

Citat:

calimero: ej Dimkovicu, jel moze neki link/vest/bilo sta sto se tice posledica lose implementacije, loseg samog PDF-a ??

neki link gde se vidi kako je neko iskoristio slabosti PDF-a o kojima ti pricas ;)

mislim PDF postoji cak i duze nego Windows95, imaju ga gotovi svi korisnici racunara (ne samo Windows korisnici vec i Linux i Mac) tako da mi je prosto neverovatno da za Windows postoji 1001 virus/rupa ili sta vec, a za PDF i za sve ove godine ni jedan ? plz daj neki link.

BTW nemoj samo ponovo linkove nalik onima u kojima se govori kako je Mac OS X busan a realno nemamo ni jedan virus.

au covece , de ti zivis ?
lepo te je Dimkovic izbombardovao linkovima

a sto se tice javascript-a u flashu, nisam mogao da verujem kad sam to video
vise vremena mi je trebalo da nadjem nekakvu dokumentaciju o tome nego da napisem fuzzer :)

inace, bas sam letos pisao jedan exploit za adobe pdf reader , radilo se o necemu slicnom dereferenciranju null pokazivaca , samo ovaj nije bio null ,
pa sam uz pomoc javascript-a naterao reader da alocira gomilu memorije dok nije
dostigao adresu na koju je pokazivao taj pokazivac, ostalo je vec laganica manje vise

problem s java script-om je sto umnogome povecava "attack surface"
a i umnogome olaksava pisanje stabilnih eksploita , posto sam dokument
u neku ruku moze da sadrzi izvrsni kod

inace rec je o ovom bug-u :
http://www.coresecurity.com/content/adobe-reader-buffer-overflow

nije postojao eksploit za linux pa sam se ja igrao

Re: German government warns against using MS Explorer 18.01.2010. u 20:45 · pre 204 meseca #12

Citat:

Ivan Dimkovic: STA CE DOKUMENT FORMATU JAVASCRIPT?

Kako šta če? Pa, kako će da radi JavaVIEW na primer? Kako u ptex]\LaTeX[/tex]-u da napravim PDF dokument koji sadrži šahovski dijagram u kome možeš partiju da motaš napred-nazad? Za to se koristi JavaScript.

Potpis

Nije bitno koji su zaključci izvučeni, već kako se do njih došlo.

Re: German government warns against using MS Explorer 18.01.2010. u 23:16 · pre 204 meseca #13

Kad smo vec kod JS, zasto mislis da HTML5 nece imati JS ili neki jezik koji ce podrzavati DOM manupulations?

Inace i ja glasam da HTML5 promeni PDF/DOC/OOP zauvek! HTML4 bi vec trebao to da uradi :(

Re: German government warns against using MS Explorer 18.01.2010. u 23:48 · pre 204 meseca #14

Ne, ne mislim - ali ce sve biti fokusirano na browser produkt, znaci jedan hebeni engine, sto znaci manje odrzavanja i manje problema.

Kada hebeni PDF renderer ima svoj engine, svoj update sistem... to je haos.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 19.01.2010. u 00:15 · pre 204 meseca #15

http://news.bbc.co.uk/2/hi/technology/8465038.stm

Citat:

France has echoed calls by the German government for web users to find an alternative to Microsoft's Internet Explorer (IE) to protect security.

a i microsoftov odgovor:
http://tech.slashdot.org/story...hdot%2Fslashdot+%28Slashdot%29

Potpis

Bolje ispasti glup nego iz aviona
http://www.mulaz.org/

Re: German government warns against using MS Explorer 19.01.2010. u 00:58 · pre 204 meseca #16

Mislim da je ipak fer reci da na Win7 sa default podesavanjima (DEP ON) ovaj vuln ne funkcionise:

Medjutim, ono sto je tragicno je sto danas (2010) ima installera koji PUCAJU ako je DEP ukljucen

Cak i na 64-bitnim sistemima!

Pre neki dan sam instalirao ATI Stream SDK (za OpenCL) - pokrenem instaler... i BAM! Krah. Cim instaler krahira, znam sta je u pitanju (iz iskustva) - posto je kod mene DEP "AlwaysOn" hardkodovan u boot konfiguraciji.

Dakle, morao sam da GASIM hebeni DEP - da bih instalirao neki prokleti 64-bitni softver DANAS.

ZASTO ?!?!?!

Ajde razumem za 32-bita i legacy sisteme... tada je bilo dozvoljeno sve i svasta, igranje u data segmentu, itd...

Ali danas?!?!

Za ovo je kriv Microsoft - i niko drugi, jer dozvoljava ovakve idiotizme i sto su dizajnirali svoje API-je na nacin koji ubija kompatibilnost sa sopstvenim sigurnosnim tehnologija. Uopste me ne zanima da li je kriv njihov Installer sistem, neki plug-in ili nesto deseto - apsolutno je neprihvatljivo da se ovakve stvari tolerisu i nije mi jasno zasto ne zahtevaju za fckin "Windows" logo da aplikacija MORA raditi sa DEP "AlwaysOn" #@)*(&#@

BRE

Proklete svinjske glave iz Redmonda... glave su im u d00petu kao i obicno. One menadzerske.

Evo u cemu je problem:

http://en.wikipedia.org/wiki/Data_Execution_Prevention

Citat:

DEP problems can occasionally occur with DEP-compliant core operating system components such as Windows Explorer, Internet Explorer and Windows Installer as they support in-process third party extensions or plugins that may not be DEP-compliant.

Ko god je ovo smislio... treba ga ubiti. Zamislite koliko ce ljudi UGASITI fakin DEP i zaboraviti da ga ukljuce #@)*(&@#( Zato sto je neka njuska iz product managementa umislila da je kul dozvoliti ljudima da pisu plug-inove koji koriste hakerske trikove.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

IE_Aurora_x460.jpg39.01k

Re: German government warns against using MS Explorer 19.01.2010. u 01:05 · pre 204 meseca #17

Evo kako to izgleda:

http://social.answers.microsof...15-584b-4d07-9c66-7789da22e1ac

Citat:

This is NOT working for me. I'm trying to install the Intuit SDK version 8. This should NOT be a big deal... so, how do i permanently REMOVE DEP from my machine so it stops preventing ANY program I want from running? As it is, the situation is TOTALLY unacceptable. It's MY machine not microsofts machine. The above instructions are NOT stopping dep, i need to know HOW to remove it. NOW!

:(

Tuga...

Tuga i cemer... i to sve zato sto ocigledno ima ljudi u Microsoftu koji ne treba da rade posao koji rade.

Boga pitaj koliko ima ljudi koji su iskljucili DEP zato sto Microsoft nije imao dovoljno m00da (ili mozga... ko zna) da zahteva da sve nove aplikacije MORAJU da rade pod DEP-om, inace nema Windows logo-a niti WHQL sertifikacije ako ima drajvera u paketu #@)(*@#)(#@

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: German government warns against using MS Explorer 19.01.2010. u 01:29 · pre 204 meseca #18

Dimke, nemoj se živcirati, pređi na linux

Ali pokušaj izbeći Ubuntu ovaj put

Re: German government warns against using MS Explorer 19.01.2010. u 01:45 · pre 204 meseca #19

Ivane, ne zivciraj se, evo sredi nekako da budem na mestu tih koji te nerviraju i ja cu sve da radim kako ti kazes

Potpis

Nebojsa Milanovic:
-Trumpa smatram vrhunskim predsednikom i voleo bih da živim u državi na čijem je on čelu
-Rusija ne laže, ne vodi osvajačke ratove
-Trump je svetla tačka u USA blatu
-Elon Musk, možda najpametniji i najtrezveniji Amerikanac

Re: German government warns against using MS Explorer 19.01.2010. u 07:28 · pre 204 meseca #20

malo ste zaglibili, kako bi vi to s html5 zamjenili pdf?
HTML-> HyperText Markup Language
PDF ->Portable Document Format

odnosno pdf-u je osnovna namjena format koji je friendly ispisu, na stranu to što su sad napucali bezveze toga unutra i učinili ga nesigurnim
a html i ispis nikad neće funkcionirati kao pdf i ispis...
to je sasvim drugačiji format...

Potpis

there's no place like 127.0.0.1

Forum kao aplikacija na telefonu

Srodne teme