Microsoft Acknowledges Exploit - Suggests some workarounds while you wait

Microsoft Acknowledges Exploit
Suggests some workarounds while you wait
(old news - 11:08AM Friday Jan 30 2004)
tags: security

Microsoft has now at least conceded that the phishing exploit for IE exists in their updated knowledge base article, after a number of new scams (such as this one from FDIC) made the exploit almost impossible to ignore. Their advice to protect yourself from malicious hyperlinks while you wait for a fix? Don't click them.

In addition to the recommendation you wander the web manually typing URL's, the company also suggests you could utilize javascript commands in the address bar to properly identify the true URL. If grandma calls you concerned about the bad men on the internet reported on the nightly news, you can simply say:

"Don't be a wuss, Grandma. Type: javascript:alert("Actual URL address: " + location.protocol + "//" + location.hostname + "/") in your address bar and let me be."

What's odd here is that Microsoft claims they've dedicated themselves to security (again); so does a delay in a patch for the exploit mean they can't figure it out, or they're waiting until the next round of patches on February 10? Microsoft switched to a monthly patching cycle in part to avoid confusing regular users with too many patches, yet the security bulletin for January failed to even mention the flaw, despite a serious rise in scams targeting financial institution customers

Microsoft has confirmed a coming change in the way IE supports usernames and passwords in the address bar. Such data is usually presented in the »username:password@webaddress format, the exploit taking advantage of the @ character to help disguise a phony address (the former) as a legit address (the latter).

As a result, Microsoft will be eliminating IE's support of usernames and passwords in HTTP and HTTPS URLs - meaning websites that still use the exploitable syntax will be forced to change their methods (use of "IntenetSetOption" function, etc.). A second exploit that allows scammers to disguise true file extensions was unveiled earlier this week.

1 In 10 DNS Servers Vulnerable To Cache Poisoning

ISPs Fear Monster 40Gbps DDoS Attacks

Zone Alarm Pro Free Just For Today

Microsoft Discontinuing OneCare

Srizbi Botnet Servers Flee To Estonia

Can Spam Act Celebrates Five Years Of Ineffectiveness

37% Of Malware Originates In U.S.

Using PS3's To Forge Site Certificates

Forums » Microsoft Acknowledges Exploit


	view: topics flat text	Post a:

SKYHN Lu.. Lu.. Lulululu Premium join:2001-09-16 99999	The one thing to end all windows exploits: A patch that disables windows
	permalink · 2004-01-30 10:47:04 ·

Dude What Happens When I Do This Premium join:2000-11-20 Chicago, IL clubs:	Re: The one thing to end all windows exploits: scratches head and continues to realize microsoft is run by a bunch of senior citizens
	permalink · 2004-01-30 17:27:49 ·

skiguy219 join:2001-02-01 Beaverton, OR clubs:	Re: The one thing to end all windows exploits: I DONT GET HOW HARD THIS IS. Netscape just shows the true location in the address bar! Can a company who sells millions of dollars worth of software not figure that out!!!Come on, if one can why cant the other.
	permalink · 2004-01-30 18:18:37 ·

rtcy RTCY Premium join:1999-10-16 Norwalk, CA	ALL MICROSOFT NEEDS IS A LINK TO WWW.MOZILLA.ORG and kill active X out of windows once and for all, they lost that battle.
	permalink · 2004-01-30 18:39:22 ·

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Erie, PA

edit:
January 30th, @09:32PM

Re: The one thing to end all windows exploits:

said by rtcy :

and kill active X out of windows once and for all, they lost that battle.

sprithippt!!?!??

THEY DID?????

You do actually own a computer....right?

Now excuse me while I clean the Pepsi out of my keyboard, that was the single funniest thing I've read all day. ActiveX ...dead, ROFLMAO.
--
Japan-- Now with 30% more climbable telephone poles!!

permalink · 2004-01-30 21:31:40 · Print ·

rtcy RTCY Premium join:1999-10-16 Norwalk, CA ·Verizon west (ex G.. ·Verizon FIOS	Re: The one thing to end all windows exploits: said by Combat Chuck : said by rtcy : and kill active X out of windows once and for all, they lost that battle. sprithippt!!?!?? THEY DID????? they SHOULD! but WON'T (remove active x) is that what you are asking??? cause I lost you. is your keyboard ok?:p
	permalink · 2004-02-03 19:39:12 · Print ·

GNXPower Got Boost? Premium join:2003-12-18 Huntington Beach, CA	I have the work around Not using IE.
	permalink · 2004-01-30 10:50:17 ·

Steve ho ho ho dammit Consultant join:2001-03-10 Yorba Linda, CA	"Don't click links" Kinda like "Don't send links to your friends; instead, print out a web page and fax it to them"
	permalink · 2004-01-30 10:53:39 ·

SND2005
Premium
join:2001-09-15
Im Over Here

·CWLab

edit:
January 30th, @11:00AM

Hmmm....

It sucks that M$ has such a crappy attitude towards this- if they would just fess up and fix the thing people would more highly regard them.

On the other hand though, it doesn't take much common sense to avoid this. Are people really so stupid and/or lazy as to not book mark a site?! Yes, its an exploit- but thinking wouldn't hurt either. I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming.

permalink · 2004-01-30 10:59:51 · Print ·

Torn Premium join:2001-05-11 USA	Re: Hmmm.... said by SND2005 : I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming. Microsoft is a target, that's why.
	permalink · 2004-01-30 11:12:51 ·

ikarus1
Premium
join:2002-10-23
Urbanna, VA

Re: Hmmm....

said by Torn :

said by SND2005 :
I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming.
Microsoft is a target, that's why.

Naw... Microsoft is a joke that is why. Look it is really simple. It really is, and you Microsux lovers are in serious denial...

We (Computer Scientists) have known for forty years that it was stupid to allow Joe $hit the RagMan... AKA LUSER to run with administrative privs on any system. Now, kiddies, the truth is Microsux knew that when they started down this path. They knew they shouldn't let, "Bubba LUSER", run with admin privs but they did not know how to get around the problems that would cause with MS-DOS apps and their installed base.... sooooo.... they just decided in their marketing driven engineering shop to IGNORE CONVENTIONAL PRUDENCE... They knew they shouldn't do it. They did it anyway. Now they are running on top of some forty or fifty million lines of code that was written on top assumptions which are known to be BAD PRACTICE. They aren't going to fix this problem because they can't fix it. Their system is a monolith, commonly recognized as BAD PRACTICE by the Computer Scientists world wide. Their monolith presumes the user at the console should have administrative rights, commonly recognized as BAD PRACTICE by Computer Scientists world wide.

Kiddies... this is not that hard to understand... but there are some who are so deeply in denial that saying it won't help... Microsloth knowingly screwed the pooch to ensure that they kept market share, with the mistaken belief that they could defy conventional wisdom and survive it. NOW YOU ARE PAYING THE PRICE... and kiddies, that is something you can't deny.

-m-
--
»www.freeantennas.com

permalink · 2004-01-30 11:40:40 · Print ·

Freezone

join:2000-09-29
Southfield, MI

Re: Hmmm....

said by ikarus1 :
Microsloth knowingly screwed the pooch to ensure that they kept market share, with the mistaken belief that they could defy conventional wisdom and survive it. NOW YOU ARE PAYING THE PRICE... and kiddies, that is something you can't deny.

-m-

Well, I am pissed I did not think of doing what MS did first

. Having Bill Gates money does not hurt at all. I am sure he losses sleep everynight with all the trouble he has caused.

Microsoft survived becuase they are a business. We had and have better OS made by scientist. Scientist are still pissed that us LUSER have the power that we have. For the better part of the last 40 years computing belonged only to the scientist. Companies like MS and Apple came and gave some of that power to the people.

I thank god for the PC, becuase I am glad the world of dumb terminals did not survive. Despite the constant problems with windows I will keep my computing power in my own controll thank you.

permalink · 2004-01-30 11:58:13 · Print ·

ikarus1 Premium join:2002-10-23 Urbanna, VA	Re: Hmmm.... said by Freezone : I thank god for the PC, becuase I am glad the world of dumb terminals did not survive. Despite the constant problems with windows I will keep my computing power in my own controll thank you. No Bill will keep your computer in his control and let you think that you have control... »www.nsclean.com/nsakey.html -m- -- »www.freeantennas.com
	permalink · 2004-01-30 13:11:52 · Print ·

Freezone join:2000-09-29 Southfield, MI	Re: Hmmm.... Rather think I do then what your scientist had in store for me. Talk about big brother.
	permalink · 2004-01-30 13:21:25 ·

mujahid0 join:2003-08-09 Hayward, CA	Bravo Freezone! Well said, I add my voice to yours!!
	permalink · 2004-01-30 13:59:29 ·

roahboah

join:2000-08-18
Rumney, NH

said by ikarus1 :

said by Torn :

said by SND2005 :
I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming.
Microsoft is a target, that's why.

Naw... Microsoft is a joke that is why. Look it is really simple. It really is, and you Microsux lovers are in serious denial...

We (Computer Scientists) have known for forty years that it was stupid to allow Joe $hit the RagMan... AKA LUSER to run with administrative privs on any system. Now, kiddies, the truth is Microsux knew that when they started down this path. They knew they shouldn't let, "Bubba LUSER", run with admin privs but they did not know how to get around the problems that would cause with MS-DOS apps and their installed base.... sooooo.... they just decided in their marketing driven engineering shop to IGNORE CONVENTIONAL PRUDENCE... They knew they shouldn't do it. They did it anyway. Now they are running on top of some forty or fifty million lines of code that was written on top assumptions which are known to be BAD PRACTICE. They aren't going to fix this problem because they can't fix it. Their system is a monolith, commonly recognized as BAD PRACTICE by the Computer Scientists world wide. Their monolith presumes the user at the console should have administrative rights, commonly recognized as BAD PRACTICE by Computer Scientists world wide.

Kiddies... this is not that hard to understand... but there are some who are so deeply in denial that saying it won't help... Microsloth knowingly screwed the pooch to ensure that they kept market share, with the mistaken belief that they could defy conventional wisdom and survive it. NOW YOU ARE PAYING THE PRICE... and kiddies, that is something you can't deny.

-m-

Okay, great. Do you actually propose an alternative, or are you just pointing out Microsoft's apparent greed and/or sloth?
Thanks,
roah

permalink · 2004-01-30 13:07:49 · Print ·

ikarus1
Premium
join:2002-10-23
Urbanna, VA

Re: Hmmm....

said by roahboah :

said by ikarus1 :

said by Torn :

said by SND2005 :
I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming.
Microsoft is a target, that's why.

Naw... Microsoft is a joke that is why. Look it is really simple. It really is, and you Microsux lovers are in serious denial...

We (Computer Scientists) have known for forty years that it was stupid to allow Joe $hit the RagMan... AKA LUSER to run with administrative privs on any system. Now, kiddies, the truth is Microsux knew that when they started down this path. They knew they shouldn't let, "Bubba LUSER", run with admin privs but they did not know how to get around the problems that would cause with MS-DOS apps and their installed base.... sooooo.... they just decided in their marketing driven engineering shop to IGNORE CONVENTIONAL PRUDENCE... They knew they shouldn't do it. They did it anyway. Now they are running on top of some forty or fifty million lines of code that was written on top assumptions which are known to be BAD PRACTICE. They aren't going to fix this problem because they can't fix it. Their system is a monolith, commonly recognized as BAD PRACTICE by the Computer Scientists world wide. Their monolith presumes the user at the console should have administrative rights, commonly recognized as BAD PRACTICE by Computer Scientists world wide.

Kiddies... this is not that hard to understand... but there are some who are so deeply in denial that saying it won't help... Microsloth knowingly screwed the pooch to ensure that they kept market share, with the mistaken belief that they could defy conventional wisdom and survive it. NOW YOU ARE PAYING THE PRICE... and kiddies, that is something you can't deny.

-m-

Okay, great. Do you actually propose an alternative, or are you just pointing out Microsoft's apparent greed and/or sloth?
Thanks,
roah

Sure. Linux and FreeBSD are both mature enough for the desktop, have excellent applications... shoot the other day I was running OpenOffice and working with Excel spread sheet files... OpenOffice is as good as MS Office and that is the application that is keeping business people from migrating to a free operating system.

It is like IBM is saying in their ads, "The Future is Open".

Get on board or get left behind.

-m-
--
»www.freeantennas.com

permalink · 2004-01-30 13:20:09 · Print ·

nixen
Rockin' the Boxen
Premium
join:2002-10-04
Alexandria, VA

·Cox HSI

·Speakeasy

said by roahboah :
Okay, great. Do you actually propose an alternative, or are you just pointing out Microsoft's apparent greed and/or sloth?

It's called use an operating system that enforces privlege levels and separation. Any UNIX variant does this. And no, I'm not a Linux zealot. All you have to do is look at Apple's OS-X (built on top of BSD).

Hell, the people at MicroSoft that first came up with NT were ex-VAX people and knew better than to create the current mess. NT sorta used to have separation. Then, they decided, "let's take our consumer OS line and our business OS line and merge them." Unfortunately, in the process, they gutted the miniscule level of protection that was in their business OS line.

But hey, it shure duz play gamez real good.

Hope every last Windows user who doesn't protect themselves from MS design defects learns the hard way what crap they're using.

-tom
--
"There are 10 types of people in the world... those who understand binary and those who don't."
"That's only 2 types of people, moron"

permalink · 2004-01-30 21:24:11 · Print ·

anotamous

@66.168.x.x

Re: Hmmm....

I don't suppose you've ever looked at a functioning active directory structure, have you? Don't bother answering... most people who sit back all smug in their guru chairs wouldn't dare dirty their hands on a Windows machine.

My company has been in business for over 22 years, and I have to deal with (read: fix) systems of all makes, running every OS you can think of. Yeah, I even have punks bringing in Solaris crap. Trust me, chief, the line seperating Operating Systems is getting thinner.

You say look at OS-X? I say look at 2k, XP, Longhorn, 2k3... they're all just Unix with a pretty shell. Sure, that'll probably give you a coronary or whatnot, but you can't deny the truth. Any tech worth two cents will agree.

permalink · 2004-02-14 02:36:00 · Print ·

Beeper Part Of The Problem join:2001-09-27 Dayton, OH clubs:	said by ikarus1 : We (Computer Scientists) have known for forty years that it was stupid to allow Joe $hit the RagMan... Yours is the superior intellect. -- Guaranteed Fear and Loathing. Abandon all hope. Prepare for the Weirdness. Get familiar with Cannibalism.
	permalink · 2004-01-30 15:48:33 ·

ikarus1 Premium join:2002-10-23 Urbanna, VA	Re: Hmmm.... said by Beeper : said by ikarus1 : We (Computer Scientists) have known for forty years that it was stupid to allow Joe $hit the RagMan... Yours is the superior intellect. Education does not equate to intellect... Microsoft employees Computer Scientists as well... You figure it out, it isn't really that difficult. -m- -- »www.freeantennas.com
	permalink · 2004-02-01 15:11:23 · Print ·

BSDUser

@verizon.ne

Computer scientist you are not, a prepubescent you are. Seriously, I bet you're a closet Windows user.

I use Microsoft Windows (notice the lack of script kiddie/Linux zealot mis-spelling(s) of Windows and Microsoft) and like it. I also use FreeBSD and Linux. (*Gasp*!) and love them as well. They have their places. If you don't like it, then don't use it. Simple huh?

Remember, Linux is for people who hate Windows. BSD is for people who love Unix.

permalink · 2004-01-30 20:33:12 ·

ikarus1
Premium
join:2002-10-23
Urbanna, VA

Re: Hmmm....

said by BSDUser:
Computer scientist you are not, a prepubescent you are. Seriously, I bet you're a closet Windows user.

I use Microsoft Windows (notice the lack of script kiddie/Linux zealot mis-spelling(s) of Windows and Microsoft) and like it. I also use FreeBSD and Linux. (*Gasp*!) and love them as well. They have their places. If you don't like it, then don't use it. Simple huh?

Remember, Linux is for people who hate Windows. BSD is for people who love Unix.

Computer Scientist, I am. and child if we're remembering, let us remember that 'BSD' ain't System-V, and SCO is sueing for the right to take OpenSource off the net. If there is one thing I'll garauntee you it is that the *BSD you use DOES violate SCO's rights...

Duh... now go learn something and come back when you understand wheel...

-m-
--
»www.freeantennas.com

permalink · 2004-01-31 18:09:09 · Print ·

rtcy
RTCY
Premium
join:1999-10-16
Norwalk, CA

·Verizon west (ex G..

·Verizon FIOS

we've all heard this threat since the early 90's and so far there's been 2 minor flaws in Netscape a.k.a Mozilla, and they were truly harmless.

there's at least 1 per month on IE or OE or Outlook, and let's not forget the whole Office suite, that also relies on Active x and many of the same DLL's that were once not FORCEFULLY entrenched in the OS.

remenber when you COULD unistall IE? in early 95, then they decided to FORCE it in the desktop.

permalink · 2004-01-30 18:48:02 · Print ·

MacUser04

@12.151.x.x

quote:
I bet if people spent half as much time trying to crack other browsers and Linux that there would be just as many issues. So to all you smug users of other browsers- just wait, your time is coming.

Bszzt, Wrong. It's because of poor code and security on the Windows side. UNIX'es are more secure and that's an undeniable fact. It has nothing to do with focusing attnetion on Windows. It has to do with the fact that on Windows security was an afterthought, where with UNIX'es it was the main goal.

Difference in development ideologies and the fact that UNIX has been around since the 60's make it a much more stable and secure platform than Windows can ever hope to be.

permalink · 2004-01-30 11:40:51 · Print ·

SND2005 Premium join:2001-09-15 Im Over Here ·CWLab	Re: Hmmm.... Haaa haaa haaaaa haaaaa......You freakish people are so funny. This isn't even about a "who is better" type war as you all would like to make it. (Windows would appear to better if you look at sales.. ) The problems will come for whomever is the leader in the market- which is Mircosoft, so eat it.
	permalink · 2004-01-30 11:52:14 ·

MacUser04 @12.151.x.x	Re: Hmmm.... Being the leader does not mean they will always be a target. You can do things to minimize the risk of things happening but, sadly, M$ didn't choose to do that.
	permalink · 2004-01-30 13:46:35 ·

Talis join:2001-06-21 Houston, TX	said by MacUser04: It has to do with the fact that on Windows security was an afterthought, where with UNIX'es it was the main goal. Sooo.. they wrote security code just to write security code? What exactly were they securing? Maybe perhaps the OS was the main goal? I don't mind a good 'UNIX IS GOD' rant - well maybe I do - but it should at least be semi-credible.
	permalink · 2004-01-30 14:18:55 ·

ikarus1
Premium
join:2002-10-23
Urbanna, VA

Re: Hmmm....

said by Talis :

said by MacUser04:
It has to do with the fact that on Windows security was an afterthought, where with UNIX'es it was the main goal.
Sooo.. they wrote security code just to write security code? What exactly were they securing? Maybe perhaps the OS was the main goal?

I don't mind a good 'UNIX IS GOD' rant - well maybe I do - but it should at least be semi-credible.

Oh, Lord, Please deliver me from idiots... Naturally the object was to secure the OS first. What? Is it better to secure only user land? You do know what user land is, right? Oh, Doh?! (slapping my head violently) of course you don't know what user land is... you are a Microsoft Certified Systems Engineer... I knew that.

-m-
--
»www.freeantennas.com

permalink · 2004-02-01 14:56:15 · Print ·

raye Premium join:2000-08-14 Orange, CA	If they begin targetting Mozilla, we canthten have a comparison as to how quickly the open-source community fixes its problems vs. the closed software community (i.e. Microsoft). My money is on open-source.
	permalink · 2004-01-30 14:58:17 ·

nasadude join:2001-10-05 Rockville, MD	like all good monopolies.... ...Microsoft could give a sh*t about their customers. Besides, they're not interested in browsers anymore, they won that war.
	permalink · 2004-01-30 11:12:01 ·

rchandra
Stargate S G-1 And Atlantis Fan
Premium
join:2000-11-09
14225-2105
clubs:

typical MS

Typical Microsoft: break protocols, then claim it's sooooo much better for you. Market the heck out of it, then all but the sharp don't know any better. Dear MS: it's not rocket science; Mozilla for example has no problem with this, and we don't know what your problem is in obscuring stuff.

Actually, come to think of it, this is also right up their alley. Let's not show the user what the Web server sent you on an error; they probably can't handle that. No, let's put up our own "friendly" page with 3 paragraphs of cruft explaining what the problem might be instead, while the user has to wade through all that in order to find out what the problem really was. "Obscure as much of the real world as possible" is the Microsoft way, so it's no big surprise that they hide a NUL or SOH.

It's also soooo comforting to know that if it's two days after their monthly release cycle day when a new problem is discovered that my system will be broken in some way for another 28 or so days. I guess it's too "confusing" to have a properly working system.
--
English is a difficult enough language to interpret correctly when its rules are followed, let alone when a writer chooses not to follow those rules. Blog is here

permalink · 2004-01-30 11:13:43 · Print ·

Maxo
Your tax dollars at work.
Premium,VIP
join:2002-11-04
Tallahassee, FL
clubs:

·Embarq

WtF?

quote:
As a result, Microsoft will be eliminating the ability of IE to recognize the "@" character in URLS altogether - meaning websites that still use the character to denote user login information will need to change their ways once the next patch is applied. A second exploit that allows scammers to disguise true file extensions was unveiled earlier this week.

Huh? Mozilla firebird doesn't allow Phishing, yet I can still use username:password@domain-name.com. Why can't IE do the same.
--
Girls don't really like me That's why I hate myself Maybe it's cause of the way I look Or maybe it's something else »maxolasersquad.com

permalink · 2004-01-30 11:16:45 · Print ·

Freezone join:2000-09-29 Southfield, MI	Re: WtF? Ok i have to admit this is bad.
	permalink · 2004-01-30 12:00:56 ·

Morac join:2001-08-30 Riverside, NJ	Re: WtF? It would be, if it were true.
	permalink · 2004-01-30 13:38:15 ·

Doctor Dan
Weapons Of Masturbation
Premium
join:2001-10-20
Papiopolis

·inmotionhosting

·Verizon Online DSL

Not limited to IE...

The [url]@[ip address] spoof problem is not limited to IE.

I tried the following on a Mac using Safari 1.0, IE 5.2.2, Mozilla 1.6, and Firebird 0.7:

»www.chase.com@158.171.210.42

and all the browsers redirected to 158.171.210.42 (Fleet Bank's website) rather than generating an error or displaying Chase Manhattan Bank's website.

- Dan
--
When are you going to let me out of this box?

permalink · 2004-01-30 11:17:45 ·

See 9 replies to this post

CCCMTech
Premium,VIP,MVM
join:2002-05-17
Pound, VA

Easy to to avoid being phished

If you are going to a site that you fear may be a phishing exploit (site you don't trust)

Simply right click the link and goto properties there you will see "somedomain.com%01@realdomain.com" except the %01 will be a wild character more like ||. Haven't ran across the download phishing yet. Should be able to do the same on it though.

(smart site would disable right click if they're going to phish).
--
Thank you for choosing SBC Internet Services. My name is Rick. How may I help you today?

permalink · 2004-01-30 11:29:49 · Print ·

Jason Levine Premium join:2001-07-13 Albany, NY	Re: Easy to to avoid being phished said by CCCMTech : (smart site would disable right click if they're going to phish). That wouldn't stop the user from double-checking the URL. They would just have to go to File->Properties. -- -Jason Levine http://www.jasons-toolbox.com/ http://www.PCQandA.com/ http://www.urateit.com/
	permalink · 2004-01-30 12:52:33 · Print ·

CCCMTech Premium,VIP,MVM join:2002-05-17 Pound, VA	Re: Easy to to avoid being phished That is true too. But that would be after you clicked on the phishing url and are on the fake site.. you could goto view and source on the suspected page. But that is a good idea if the site you went to isn't malicious. (ie. force itself upon you.) -- Thank you for choosing SBC Internet Services. My name is Rick. How may I help you today?
	permalink · 2004-01-30 12:56:59 ·

Morac

join:2001-08-30
Riverside, NJ

·Comcast

Old news and article is incorrect about MS's fix.

The KB in question was written over a month ago and has been reported on in the past.

In addition the following is completely untrue:

quote:
The knowledge base article does confirm a coming change in the way IE handles usernames and passwords in the address bar. Such data is usually presented in the »username:password@webaddress format, the exploit taking advantage of the @ character to help disguise a phony address (the former) as a legit address (the latter).

As a result, Microsoft will be eliminating the ability of IE to recognize the "@" character in URLS altogether - meaning websites that still use the character to denote user login information will need to change their ways once the next patch is applied.

The KB says no such thing. No where in the 833786 KB does it say that Microsoft will stop supporting the URL standard by disallowing "@" characters in the URL. Actually the KB doesn't say how Microsoft intends to remedy the problem and only lists ways to protect yourself from the exploit. I know people like to bash Microsoft when they screw up, but making things up to bash them on is ridiculous.

permalink · 2004-01-30 13:37:35 · Print ·

anon2121 @clareon.com	New News and it is correct Unless the site is spoofed: »support.microsoft.com/default.as···D;834489
	permalink · 2004-01-30 16:10:08 ·

tls663 Premium join:2004-01-30 canada	they're all bad So typical, and its not just Microsoft, its all software in general, why do they release the software/game then created patches, point releases, or my favorite the ever famous 'update'? Wouldn't it be better if they tested the product thouroughly first then release it? Could be a new idea.....maybe I'm onto something
	permalink · 2004-01-30 13:43:49 ·

Trel
Good Evening
Premium
join:2002-10-08
Hillsborough, NJ

·surpasshosting

Uh, mozilla full time anyone?

As a result, Microsoft will be eliminating the ability of IE to recognize the "@" character in URLS altogether - meaning websites that still use the character to denote user login information will need to change their ways once the next patch is applied.

Uh, bad idea.
--
I gots a nice site (I think). You can check it out by clicking the link. http://www.krahs-emag.com BTW, don't trust anything that bleeds for 7 days and doesn't die.

permalink · 2004-01-30 13:55:18 · Print ·

DoLeMiTe Yes we can't Premium join:2001-01-11 New Kensington, PA	Re: Uh, mozilla full time anyone? Since IE will no longer support the @ character, I guess links like this will no longer work.. »securityresponse.symantec.com/av···@mm.html -- Why we fight!
	permalink · 2004-01-30 14:28:34 ·

LifesTooShort @68.21.x.x	They still need to support the @ symbol... I would expect that they will still allow the @ symbol in URL's, but not recognize it as a delimiter that implies any form of authentication.
	permalink · 2004-01-30 16:22:52 ·

Doctor Dan
Weapons Of Masturbation
Premium
join:2001-10-20
Papiopolis

·inmotionhosting

·Verizon Online DSL

said by Trel :
As a result, Microsoft will be eliminating the ability of IE to recognize the "@" character in URLS altogether - meaning websites that still use the character to denote user login information will need to change their ways once the next patch is applied.

Uh, bad idea.

Considering the technical knowledge (or lack thereof) of the vast majority of computer users, this is probably a very good idea.

- Dan
--
When are you going to let me out of this box?

permalink · 2004-01-30 14:35:45 · Print ·

Pole883 Premium join:2004-01-27 Schenectady, NY	Can We Spell............ ............K-Meleon????:D:o;);) -- Pole883
	permalink · 2004-01-30 14:32:17 ·

See 6 replies to this post

tomkb Premium join:2000-11-15 Avon, OH clubs:	A terrible use of this exploit I was purchasing something on ebay just today and the thought dawned on me. What if one of these people scanned ebay all day long waiting for auctions to close and emailed phony invoices to the buyer to collect payment?
	permalink · 2004-02-02 12:45:49 ·

your comment..

Forums » Microsoft Acknowledges Exploit


Friday, 09-Jan 05:41:14	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2009 dslreports.com.republican-creole

The one thing to end all windows exploits:

Re: The one thing to end all windows exploits:

Re: The one thing to end all windows exploits:

Re: The one thing to end all windows exploits:

Re: The one thing to end all windows exploits:

I have the work around

"Don't click links"

Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

Re: Hmmm....

like all good monopolies....

typical MS

WtF?

Re: WtF?

Re: WtF?

Not limited to IE...

Easy to to avoid being phished

Re: Easy to to avoid being phished

Re: Easy to to avoid being phished

Old news and article is incorrect about MS's fix.

New News and it is correct

they're all bad

Uh, mozilla full time anyone?

Re: Uh, mozilla full time anyone?

They still need to support the @ symbol...

Can We Spell............

A terrible use of this exploit