Zero Day exploit being used to infect PCs

[FreewheelinFrank]

The VML exploit may have turned up on a web page linked to by the BBC. A page mentioned by the BBC's ClickOnline Webscape page is infected with the exploit according to Exploit Prevention Labs Link Scanner. 

Here the address of the link scanner:

http://linkscanner.explabs.com/linkscanner/default.asp

[drhayden1]

thanks for the link freewheelinfrank

and i wonder if this would be helpful to use and would it conflict with other software
http://www.explabs.com/ss/index.html

http://www.explabs.com/support/commonQA.html    ++ info++

http://www.explabs.com/media/pdf/userguide_socketshield.pdf    ++ users guide-pdf file++

has a 30 day free full version trial
    *  Stop zero-day exploits before they can access your computer
    * Block access to exploit-infected sites — even if they look harmless
    * Protect applications with unpatched vulnerabilities
    * Compatible with all major anti-virus, anti-spyware, and firewall products

[FreewheelinFrank]

I'm afraid the Wiki link was the first I'd heard of that product.

I think Polonus posted something about SocketShield from Exploit Prevention Labs, which seems to be a very similar product: maybe he'd know something about BufferShield?

[Lisandro]

someone tech told me its was your birthday today (9/24/06)
have a good one my friend

Yes, it is. Thanks 

[polonus]

Well drhayden1 and FwF and Tech (Happy Birthday to you),

The thread was here: http://forum.avast.com/index.php?PHPSESSID=711e57bad523e4cbff4aa0734057900b&topic=21601.msg180145

You could use the linkchecker, but I think the DrWeb av hyperlink-checker is also good, and the GeoTrust, because the latter is live. But because of Neal's experiences with the program, we concluded to stay clear of SocketShield. So in the light of what is happening right now, and later I do a posting on the design flaws with Window-API's, I think the only escape is browsing inside a virtual machine. Windows should have built it inside its OS long ago, after every session you can give it the three finger salute, and you stay free of whatever nastiness you would have kept there, the wipe this slate again and again system.

polonus

[Smith]

You could use the linkchecker, but I think the DrWeb av hyperlink-checker is also good, and the GeoTrust, because the latter is live.

Here is the DrWeb av hyperlink-checker and GeoTrust, I guess.  I don't know why DrWeb seems to make it hard for us to find their nice hyperlink-checker.

Also, Scroogle search plug-ins for Firefox and SiteAdvisor plug-ins for both IE and Firefox.

[FreewheelinFrank]

The VML exploit may have turned up on a web page linked to by the BBC. A page mentioned by the BBC's ClickOnline Webscape page is infected with the exploit according to Exploit Prevention Labs Link Scanner.

Looks like this was a false positive. I emailed the link to Sunbelt but they couldn't see anything on the page.

[stevejrc]

AFAIK It doesn't effect IE7.

[Smith]

AFAIK It doesn't effect IE7.

Do you mean "Protected Mode" on IE7 Vista?  Although Vista seems to have better user-right management than XP has at least, I wonder if it does more than what we can do with DropMyRights.  Just in case, I point out "Protected Mode" only works with IE7 Vista.  The quote below is from Wiki and italic is mine.

IE7 in Windows Vista incorporates additional security measures, most significantly "Protected Mode", whereby the browser runs in a sandbox with even lower rights than a limited user account. As such, it can write to only the Temporary Internet Files folder and cannot install start-up programs or change any configuration of the operating system without communicating through a broker process. This is expected to increase the security of the system considerably.[5] The Windows XP version of Internet Explorer 7 will not include "Protected Mode" operation. It also supports the Parental Controls and Network Diagnostics features which are unique to Vista.

[FreewheelinFrank]

Watch out for fake greetings cards:

We are starting to see mass mailing lures for websites that are hosting VML exploit code. Most of the sites are using updated Web-Attacker code. A recent example that came to us from Message Labs appears to lure users to the site by claiming they have received a Yahoo! Greeting Card. The site downloads and installs an Internet Explorer Browser Helper Object that directs all HTTP posts from forms to a third party, and then collects information on end-users.

http://www.websense.com/securitylabs/alerts/alert.php?AlertID=633

Windows VML Vulnerability - Frequently Asked Questions

http://blogs.securiteam.com/?p=640

[neal62]

Thanks FwF for this info. Very interesting. Sure will keep an eye out for something like this. 

[Smith]

Windows VML Vulnerability - Frequently Asked Questions

http://blogs.securiteam.com/?p=640

Q: What Internet Explorer browser versions are affected?
A: The following Internet Explorer (IE) versions are affected:
Internet Explorer 5.01 Service Pack 4
Internet Explorer 6 Service Pack 1
Internet Explorer 6 installed to Windows XP Service Pack 2

Hmmm.  XP or Vista, there is no mention of IE7 but I don't know why.

Q: Why this vulnerability is related only to Microsoft Internet Explorer (aka MSIE)?
A: Other Internet browsers, like Mozilla Firefox, Netscape and Opera use a different technique known as Scalable Vector Graphics (SVG).

No mention of IE7.  Could someone kindly tell me why IE7 is not affected?

In any case, it is quite possible that VML exploits doing their jobs underwater since the "commercial" hackers like to put keyloggers to our systems.

[polonus]

Hi malware fighters,

Malware authors try to exploit the new VML security hole in all kind of ways. Websense
found a "Yahoo e-card" that redirects to a website downloading an IE BHO that forwards all http-forms to a third party for "further investigation".
http://www.websense.com/securitylabs/alerts/alert.php?AlertID=633

These things will come to pass, that soon all users of XP SP2 will be urgently invited by MS  to install IE 7, because the security of IE 6.0 (not changed much qua design since IE 4.0 came out) cannot be trusted any longer. It means that IE actually sat on their laurels for quite some time after winning the "browser war". Hope the developments round FF 2.0 will keep them awake. And where is that early patch?

polonus

[Smith]

polonus,  FwF has already posted the same topic.

Watch out for fake greetings cards:

We are starting to see mass mailing lures for websites that are hosting VML exploit code. Most of the sites are using updated Web-Attacker code. A recent example that came to us from Message Labs appears to lure users to the site by claiming they have received a Yahoo! Greeting Card. The site downloads and installs an Internet Explorer Browser Helper Object that directs all HTTP posts from forms to a third party, and then collects information on end-users.

However, really, is IE7 that safe, using totally different structure from previous IEs?

[FreewheelinFrank]

However, really, is IE7 that safe, using totally different structure from previous IEs?

Microsoft claim so:

Will IE7 improve this spotty record? Perhaps. According to Microsoft’s Tony Chor, a Group Program Manager on the Internet Explorer team, part of the problem was old, sloppy code. “Over time, IE had developed 13 or 14 different places in the code where we place URLs. Inconsistent results allowed us to get beat. This is where we rearchitected a big part of IE so that one routine evaluates the URL.” Microsoft is betting that the new URL parser will make it easier for developers to avoid vulnerabilities in the first place and to fix them more quickly when they do appear. But only time will tell whether that effort will pay off as expected.

http://blogs.zdnet.com/Bott/?p=109#more-109

I guess time will tell.