EDIT: the french government has put out the same warning as the german government! this is serious. details here.

btw, this affects everyone using versions Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on Windows systems XP, Vista and Windows 7.

Quote
online comment
You know your product's reputation is in trouble when a government advises the public to dump it.

Quote
German government warns against using MS Explorer

The German government has warned web users to find an alternative browser to Internet Explorer to protect security.

The warning from the Federal Office for Information Security comes after Microsoft admitted IE was the weak link in recent attacks on Google's systems.

Microsoft rejected the warning, saying that the risk to users was low and that the browsers' increased security setting would prevent any serious risk.

However, German authorities say that even this would not make IE fully safe.

Thomas Baumgaertner, a spokesman for Microsoft in Germany, said that while they were aware of the warning, they did not agree with it, saying that the attacks on Google were by "highly motivated people with a very specific agenda".

"These were not attacks against general users or consumers," said Mr Baumgaertner.

"There is no threat to the general user, consequently we do not support this warning," he added.

Microsoft says the security hole can be shut by setting the browser's security zone to "high", although this limits functionality and blocks many websites.

However, Graham Cluley of anti-virus firm Sophos, told BBC News that not only did the warning apply to 6, 7 and 8 of the browser, but the instructions on how to exploit the flaw had been posted on the internet.

"This is a vulnerability that was announced in the last couple of days. Microsoft have no patch yet and the implication is that this is the same one that exploited on the attacks on Google earlier this week," he said.

...MORE...

i recommend people switch to firefox because it's safe and easy to use.



if you dont trust my link, just go to http://www.firefox.com


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."



Edited 1 time(s). Last edit at 01/18/2010 05:58PM by Gravis.

I wish our federal government would heed these warnings. So many of the government computers I have used still run on XP or 2000 with IE 6 or Netscape. You can't install something else because you have guest account privileges. The only ones that I have seen using another browser are the people working in CERTs that run Red Hat or Solaris.



Edited 1 time(s). Last edit at 01/17/2010 06:29PM by eesh.

Yup, IE 6 is the US government secure standard.

Well at least it's not as bad as the firefox javascript exploit that allows a hacker to take complete control of users computers.

Lurker. Wrote:
-------------------------------------------------------
> Yup, IE 6 is the US government secure standard.
>
> Well at least it's not as bad as the firefox
> javascript exploit that allows a hacker to take
> complete control of users computers.


Well, the office I was in did use Firefox for about a week until someone from DISA handed us a bunch of bullshit about it not being compliant with standards or something like that. How fucking hard is it for the admins to install the latest IE version? There is no excuse for letting users run IE 6.
.gov and .mil domains are some of the most targeted on the internet, but are run by some of the most ignorant of computer security.

Blessed are the murderous.



Edited 2 time(s). Last edit at 01/17/2010 07:11PM by eesh.

eesh Wrote:
-------------------------------------------------------
> Well, the office I was in did use Firefox for
> about a week until someone from DISA handed us a
> bunch of bullshit about it not being compliant
> with standards or something like that.

HAHAHAHA! have them run the acid tests with each browser and then ask about standards compliance. http://www.acidtests.org

btw, ie6 fails horrifically, firefox 3.5 is close to correct but Chrome 4 does everything 100% perfectly.

---

Lurker. Wrote:
-------------------------------------------------------
> Yup, IE 6 is the US government secure standard.
>
> Well at least it's not as bad as the firefox
> javascript exploit that allows a hacker to take
> complete control of users computers.

lay off the crack. btw, ff exploits are fixed within hours, not weeks. oh... still no patch for ie.


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."

Quote
France joins Germany warning against Internet Explorer

France has echoed calls by the German government for web users to find an alternative to Microsoft's Internet Explorer (IE) to protect security.

Certa, a government agency that oversees cyber threats, warned against using all versions of the web browser.

Germany warned users on Friday after malicious code - implicated in attacks on Google - was published online.

But Microsoft told BBC News that IE8 was the "most secure browser on the market" and people should upgrade.

Cliff Evans, head of security and privacy, said that so far the firm had only seen malicious code that targeted the older version of its browser, IE6.

"The risk is minimal," he said.

For a web user to be affected, he said, they would have to be using IE6 and visit a compromised website.

"There are very few of them out there," he told BBC News.

However, if this did occur, a PC could become infected with a "trojan horse", allowing a hacker to take control of the computer and potentially steal sensitive information.

'Sophisticated attack'

Although the vulnerability has so far been exploited only in IE6, security researchers warned that could soon change.

"Microsoft themselves admit there is a vulnerability, even in IE8,"

said Graham Cluley of security firm Sophos.

...MORE...

"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."

what do you recommend to use?

Quote
original post
i recommend people switch to firefox because it's safe and easy to use.



if you dont trust my link, just go to http://www.firefox.com

"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."

Gravis Wrote:
-------------------------------------------------------
> eesh Wrote:
> --------------------------------------------------
> -----
> > Well, the office I was in did use Firefox for
> > about a week until someone from DISA handed us
> a
> > bunch of bullshit about it not being compliant
> > with standards or something like that.
>
> HAHAHAHA! have them run the acid tests with each
> browser and then ask about standards compliance.
> http://www.acidtests.org
>
> btw, ie6 fails horrifically, firefox 3.5 is close
> to correct but Chrome 4 does everything 100%
> perfectly.
>
>
> Lurker. Wrote:
> --------------------------------------------------
> -----
> > Yup, IE 6 is the US government secure standard.
>
> >
> > Well at least it's not as bad as the firefox
> > javascript exploit that allows a hacker to take
> > complete control of users computers.
>
> lay off the crack. btw, ff exploits are fixed
> within hours, not weeks. oh... still no patch for
> ie.


Probably because FF's sole business venture involves Web Browsers, whereas IE is part of a much larger corporation (ie, Microsoft) which lacks likewise dedicated resourcing.

BTW, whatever happened to Netscape? That used to be THE browser back in the day (FF is a product of the Netscape Corporation spin-off Mozilla, correct?).

==================================================================================================
"And if any women or children get their legs torn off, or faces caved in, well, it's tough shit for them." -2LT. Bert Stiles, 505th, 339th (On Berlin Bombardier Mission, 1944).

Gravis Wrote:
-------------------------------------------------------

>
> HAHAHAHA! have them run the acid tests with each
> browser and then ask about standards compliance.
> http://www.acidtests.org


I ran Acid3 and Firefox got 93/100. Opera and Safari got 100.

ThePackLeader Wrote:
-------------------------------------------------------

>
> BTW, whatever happened to Netscape? That used to
> be THE browser back in the day (FF is a product of
> the Netscape Corporation spin-off Mozilla,
> correct?).


It's a piece of shit browser, but someone in the government liked it enough for several agencies use it on their workstations.

Blessed are the murderous.

“trojan horse” what is that? oh yea i should add i have a MACBOOK SUCKA NIGGAS!

I got that head noddin' shit dat make ya break ya neck.

ThePackLeader Wrote:
-------------------------------------------------------
> BTW, whatever happened to Netscape? That used to
> be THE browser back in the day (FF is a product of
> the Netscape Corporation spin-off Mozilla,
> correct?).

before being sold, the last version of Netscape was open sourced. from this, Mozilla arose making steps toward supporting the latest standards. displeased with the speed of the all encompassing browser/email client/etc., Phoenix was created as a speedy browser which was eventually renamed Firefox and proceeded to get bloated and slow.

---

eesh Wrote:
-------------------------------------------------------
> I ran Acid3 and Firefox got 93/100. Opera and
> Safari got 100.


both chrome and safari use the webkit rendering engine. opera was the first to make the test work but some think they just implemented the minimum in order to pass. firefox's render engine is good but it's the javascript implementation that sucks. i dont know about safari or opera but i do know that chrome does the test very fluidly which is how it should execute.

bottom line, anything besides IE6 is better.


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."

http://news.bbc.co.uk/2/hi/technology/8469632.stm

"Given the significant level of attention this issue has generated, confusion about what customers can do to protect themselves and the escalating threat environment Microsoft will release a security update out-of-band for this vulnerability," said Microsoft's general manager..."

The bad publicity has allowed rivals such as Firefox to gain market share.

In some markets, including Germany and Austria, Firefox has overtaken IE, the firm said.

Blessed are the murderous.

opera ftw

Patch is out today.

http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

If you can’t model the past, where you know the answer pretty well, how can you model the future? - William Happer Cyrus Fogg Brackett Professor of Physics Princeton University

boredom Wrote:
-------------------------------------------------------
> Patch is out today.

it's good to see a new patch but do you really think that's the only zeroday hack for IE the chinese have on hand?

bottom line, IE is the most vulnerable browser out there.


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."