Internet explorer - a safe alternative ?

theloft

While deciding about Firefox etc. I increased my Security levels on IE and disabled Active Controls (as recommended) but now every single website I open I get a box with the following message -
"Do you want to allow software such as Active X controls and plug-ins to run ?" It is so annoying, I thought it would ask me only for sites where it was necessary to use them but it pops up all the time. Sugggestions ?

theloft

Scho wrote: »

Just thought I'd clear up, IE is not UN-SAFE.
A combination of Windows XP or Windows 2000 with IE6 or 7 have not got the correct fixes in it to prevent the issues faced by Google and others being victim to a flaw. It isn't really new either, as it's called a 0-Day flaw, or something that was wrong from the release day it's just that these attacks are simply more common as of late.
Windows 8 running on Windows XP, Vista or 7 machines are safe to this problem. Windows Vista and IE7 are also safe..

Thanks for that information. I am running Windows 8 with Vista, so this should be OK. I have a combination of Avast! Windows Defender, Ad-aware & Spy-bot for Security.

jadziad

There's a fair amount of potentially misleading information on various posts here so far.

All IE versions are confirmed to be affected to varying degrees. Trusting a Microsoft PR rep when they say that upgrading to IE8 will resolve the problem is quite misleading - they said something like it having "technologies that will protect you" such as SmartScreen (limited targeted web site blacklisting) and DEP (stop some malicious attempts), but they are far from perfect and cannot be relied upon.

Here are some quotes from The Register:
http://www.theregister.co.uk/2010/01/19/microsoft_escalation_bug/
"The exploit in Canvas was "fairly reliable" at remotely executing code in tests of IE versions 6 and 7 running on Windows XP SP3"

http://www.theregister.co.uk/2010/01/19/microsoft_emergency_patch/
"The successful attacks against IE 7 and IE 8 incorporate well-known techniques to bypass DEP. So far, Dai Zovi has been able only to read sensitive files when exploiting IE 7 on Windows Vista, but he still can't modify system settings. He says he's close to being able to carry out more powerful attacks, including on IE 8, pointing out obvious limitations to the protection."

Nobody must rely on current statements and press releases to be true forever - it's fairly likely that many people are looking for ways to use this bug on any version of IE, and they will (to some degree) probably be successful.

It's also worth noting that concentrating on this one bug is just a small part of the much bigger picture - it's currently much more dangerous to have out-of-date Adobe Flash or Adobe Reader installed.

Coopdivi

In addition to using a browser other than Internet Explorer I would suggest visiting Secunia Online Software Inspector and doing a scan. This will tell you whether there are any vulnerabilities in many of the major programs on your computer complete with links to the appropriate websites for updates. It is free and perfectly safe.

http://secunia.com/vulnerability_scanning/online/

kwikbreaks

The register had another story on this one ..

http://www.theregister.co.uk/2010/01/19/microsoft_xp_ie6_windows_7_security_nightmare/

It seems Microsoft are using this as an opportunity to spin an "upgrade to Windows 7" message.

You really do have to admire their brass neck :T

theloft

Coopdivi wrote: »

In addition to using a browser other than Internet Explorer I would suggest visiting Secunia Online Software Inspector and doing a scan. This will tell you whether there are any vulnerabilities in many of the major programs on your computer complete with links to the appropriate websites for updates. It is free and perfectly safe.
http://secunia.com/vulnerability_scanning/online/

Thanks for the tip, this useful tool found 3 programs which needed updating and were vulnerable. I think everyone should give this a try.

theloft

jadziad wrote: »

There's a fair amount of potentially misleading information on various posts here so far. All IE versions are confirmed to be affected to varying degrees. Trusting a Microsoft PR rep when they say that upgrading to IE8 will resolve the problem is quite misleading It's also worth noting that concentrating on this one bug is just a small part of the much bigger picture - it's currently much more dangerous to have out-of-date Adobe Flash or Adobe Reader installed.

This was confirmed when I ran the secunia tool recommended by Coopdivi. My Adobe Flash, Reader and Live Player were all out of date.

Scho

Just thought I'd add a quick post that Microsoft have now issued a patch to (hopefully!) fix the flaws in the IE browsers as well as parts of the MS Office package that use some of these functions too.
The Register Article: www. theregister. co. uk/2010/01/20/ microsoft_emergency_ie_update/
(newish user so can't post full links yet)

Should be releaed 10AM Seattle time - so about 7 or 8 hours difference will make it about 5 or 6PM UK time I think.

Saved that Secunia link too, nice one Jadziad.