IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

[GreyGeek]

A hacker posted IE6 & 7 exploit code to Bugtract yesterday, according to an article in the Guardian's Technical Blog.

Some news outlets reported only that the critical security vulnerability that was reported over the weekend but don't mention that it was "reported" by hackers who posted proof code on Bugtract.

The technical description of the exploit is here.

Microsoft admitted the existence of the security flaws in IE6 & 7, making references to new public reports.

But, and it is a BIG BUT, The Register reported a similar bug in IE8. The article quotes two "unidentified" souces;

The flaw in IE 8 can be exploited to introduce XSS, or cross-site scripting, errors on webpages that are otherwise safe, according to two Register sources, who discussed the bug on the condition they not be identified. Microsoft was notified of the vulnerability a few months ago, they said.

How many months have users of Windows had their personal information at risk? One can only guess, but I have no doubt that there are some Windows users who have or will find out that their Windows box is part of a bot farm and/or their bank account was suddenly emptied out, or someone bought new merchandise using their personal info.

IF you still HAVE to run Windows for some reason BE SURE that you've installed FireFox and hidden or removed IE's menu shortcut. On my one Windows box I have renamed IE.

[KeithZG]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

I just use Konqueror. Yes, on Windows too

Also, Chrome is another alternative that runs quite well on all the main desktop OSes, and admittedly it has a much smaller footprint than installing KDE to Windows (although, if you like KDE and you're forced to use Windows sometimes, why not? Maybe it's just habits, but these days I far prefer Dolphin and Konqueror to Windows Explorer).

Hell, you can even run Arora on Windows!

Or in other words, there are quite a few alternatives to IE, even on Windows (you could even go with Opera, although of course that isn't OSS...I'd mention Safari but Apple seems oddly fixated on competing with IE in even the "huge security risks" field, especially the version for Windows).

[kjjjjshab]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

...IF you still HAVE to run Windows for some reason BE SURE that you've installed FireFox and hidden or removed IE's menu shortcut. On my one Windows box I have renamed IE.

The biggest reason for "having to run Windows" is to be able to use IE... >

But luckily, I (actually Mozilla) have long ago convinced my wife that for any non-work needs, FF is the only solution... so this exploit probably doesn't affect the non-surfers, correct?

[Ole Juul]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

The biggest reason for "having to run Windows" is to be able to use IE...

Yes, so one can see IE's quirky rendering and know what all those IE users are seeing that they shouldn't be.

Not that I care. I use Dillo a lot. :P

[GreyGeek]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

....
so this exploit probably doesn't affect the non-surfers, correct?
...

That's the way I read it..... BUT .... Microsoft, it appears, knew about this hole for months and kept it secret. I also know of several (dozens, in fact, over the years) of exploits that Microsoft knew about, sometimes keeping them secret for a year or more, allowing hundreds of thousands Windows boxes to become infected, have personal info stolen, etc... All the bad stuff. So, surfing in Windows is a HUGE risk, even if you delete IE.

[Telengard]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

Thanks for keeping us informed, but how is this news? I mean, Internet Explorer and Outlook Express have been the source of 90% of Windows security bugs for many years now. No one who reads the news should be surprised by this.

[GreyGeek]

Re: IF you STILL use IE6 or 7 (8?) time to switch to FireFox!

How is it news?

Obviously it's not to us seasoned Linux users, or folks who've had their personal info stolen and moved to Linux for safety, but, the fact that Microsoft keeps serious bugs secret for months at a time was probably a shocking revelation to 1,300,000 Windows users whose box was found in that GIGANTIC Windows bot farm earlier this fall.

And, even in Penguin land there are Linux users who still don't believe that Microsoft's software is as insecure as it is.