More information: http://www.secunia.com/advisories/10395
I just learned of a new and very dangerous exploit for Internet Explorer. If you've been around the block long enough, you've seen the URL trick that involves spoofing legitimate domain names by using user authentication to make a URL look valid at its root. For example, you might see a URL like this: http://microsoft.com:[email protected]/files/report.html The above is hypothetical, but you get the point. The @ is actually a signal that you're logging into the site after the @, that is, 129.79.xxx.xxx. Your username is microsoft.com and your password is windows. It's not hard to see why this fools many people: they think it's a URL to Microsoft. This is one of the most popular ways scammers trick people into giving out all kinds of sensitive information (like usernames and passwords). Well, it just got worse. An Internet Explorer URL Spoofing Vulnerability has been found that can actually mask the URL that you're at and replace it with something arbitrary. You can test IE right here: http://www.secunia.com/internet_explorer_address_bar_spoofing_test/ Even though the HTML points to http://www.microsoft.com%[email protected]/internet_explorer_address_bar_spoofing_test/, IE will follow that link but http://microsoft.com is what you'll see in your address bar. Get ready for a deluge of spam exploiting this. This one is a little scary. There is no security patch yet, and no workaround short of installing a different browser. For those of you in a sysadmin position, it might be good to educate your users a little bit. I'll update MCN if a patch becomes available. ====================================== Andrew Schuricht Consultant, Las Vegas Springs Preserve Project --- You are currently subscribed to mcn_mcn-l as: [email protected] To unsubscribe send a blank email to [email protected]
