Uncle Bill says: I found the final solution for my IE!!!

[Ciccioniti]

Ciao everybody!

The reason why I post here it's because I would like to know if what I have just read on a French PC magazine it's true. You know, in this last weeks/months Internet Explorer has been the victim of many attacks :eek: :confused:

The article I just read while being in France for business was stating that Microsoft has found the final solution for his Internet browser. In other words they say they found a code which originally belongs to a software owned by a german company (Intrashop or Intershop?!?)which is the key to block any kind of intrusion of a "bad" person in IE. The article speaks about a sort of "total protection" given by this code - obviously by accident - to the Internet browser of Uncle Bill.

As I'm thinking more and more to move to Mozilla, I wanted to know if anybody out there had heard something similar about this.
Ciao!!! :D :D

[killingspree]

Originally posted by Ciccioniti
the key to block any kind of intrusion of a "bad" person in IE. The article speaks about a sort of "total protection"

does it prevent IE from being launched?

no seriously, this sounds ahmm... a little far fetched, to say at least. so go ahead, get your copy of firefox at www.mozilla.org/firefox and experience how comfortable browsing can get ;)

cheers
steVe

[Neo Neko]

Nothing short of a total rewrite is likely to do anything substantial for security. And then only if they remove alot of features and integration. I was reading about recent asp.net vulnerabilities. (technically unrelated to IE) One would allow an intruder to freely acces restricted files by simply changing the last backslash in a URL to a forward slash. That is bad enough. What's worse. The vulnerability bypassed any and all NTFS security. That should not be possible. Not at all. In Unix systems everything builds on everything else. File system permissions are at the heart of alot of security. If the file system says no then your program "can't" have access period. The fact that ASP.net can bypass this shows how ludicrous their claims of being security concious are. There is no reason for ASP.net to be able to bypass NTFS permissions. The fact that it can and so easily shows that their products are insecure to the core.

What's funnier. If you use frontpage it used to mess up alot of URLs in just that manner on purpose to break compatability with netscape or other competitiors browsers. Talk about shooting yourself in the foot.

I had a CIS instructor who's class page was written in frontpage. It was a pain to view in anthing other than IE. Before we figured out what the problem was the site was just unviewable unless you were in IE. After we figured it out it was a mmatter of copy and paste while editing the URL. Since it was a small static page with just refferences for class we took the liberty of "fixing" it. When we gave it to him saying that this would fix his page he said it was not his page that was broken. It was out browsers. The guy does not teach there anymore. Which although unrelated to the subject is just as well. What was ironic is that shortly after the incident Mozilla and phoenix got a patch to automate the correction of those URLs so they are transparently viewable.

[Mug Funky]

i kinda feel bad for lecturers like that. universities are of the opinion that if somebody "knows" computers, they can teach anything that can be run on them. consequently these poor bastards get fired all the time for being so useless.

i had a PC IT guy try to teach us LightWave 5.6 on a mac. it was excruciating! the poor guy had no idea at all - he was getting a blank screen at render simply because he was pointing the camera in the wrong direction.


neo: is that true about the backslash/forwardslash thing bypassing NTFS security?? that definitely shouldn't be possible. it seems to me that MS must have gone out of their way to introduce a security flaw this stupid - isn't it just easier to let the file system handle the permissions with no exceptions?

[Neo Neko]

Originally posted by Mug Funky
neo: is that true about the backslash/forwardslash thing bypassing NTFS security?? that definitely shouldn't be possible. it seems to me that MS must have gone out of their way to introduce a security flaw this stupid - isn't it just easier to let the file system handle the permissions with no exceptions?

http://www.securityfocus.org/columnists/285

Sums it up pretty well. Would really make me loose confidence in MS if I had any left. It is downright scarry how simple and severe the flaw is.

[mpucoder]

It didn't really bypass NTFS security. If you disguise the file name it uses the permissions given to aspnet. The same thing could have happened with Apache if not for the fact that Apache translates the path prior to testing for the need to authenticate.

As for a program to fix all of msie's problems, it has existed since before msie!
Open a DOS Prompt and enter:
deltree "c:\program files\internet explorer"

[windtrader]

@mpucoder,

HELP. I tried what you suggested and now I can't start up the Internet. I had to go to another PC to ask for help. What to do??

[mpucoder]

I hope you are joking. That command eliminates msie entirely.
If you actually did that you need to restore the folder from the recycle bin or _restore.
If not you'll have to get a copy of ie6setup.exe into that computer and run it.

[windtrader]

:devil: Sorry - bad joke including the one that IE is not part of the OS. At least I switched to Firefox, not sure about going to Lindows though just yet.

[mpucoder]

I'm glad it was just a joke. After you wrote that I thought "who would be naive enough to enter that command" and the answer came back "anyone dumb enough to use msie". And I didn't think that would include you.
Fortunately (for them) the deltree command is missing from Win2k and WinXP.