|
|
|
|
| Author |
Message |
T.R.
Guest
|
 Posted: Sat Dec 13, 2003 11:00 pm Post subject: DANGEROUS new internet security hole |
 |
|
I came across this in another NG and thought I would share it with the
Gateway NG. I am Cutting and Pasting the whole article below without
any commentary from me.
++++++++++++++++++++++ START ++++++++++++++++++++++++
DANGEROUS new internet security hole
Well ok maybe not all that new; but in this configeration it may just
well be new:
The bad guys have now found a new way to make you think you are at a
different web page then what you really are. It use to be if you
clicked on a link even the old type of fake URL you could still tell
where it sent you by looking at the address bar of your web browser
(IE). Now however there is a new way in which you can click on a link
that says it is a Microsoft link and when you get to the page instead
of the web browsers address bar saying where you actually are instead
using this new bug/hole the address bar can say anything they like.
To see a harmless example go here:
http://dino-soft.org/security/vun1.html
To see several different ones go here after going to the above. The
pages the below link take you to only have text telling you about it;
but the above has a Microsoft banner to make it look more real:
http://dino-soft.org/security/newurlhole.html
With this as with other security holes it goes to show that unless you
actually type in the address you are not sure you are going to where
the link points. Even when you do type in the URL address into the
address bar, if the page is a malicious page it could make it's self
look like anything it wants. Like maybe sending you an official
looking email from your credit card company or bank or what ever and
then when you go there it looks for all the world like it is
legitimate; but it isn't and if you give up your account number and or
pin number you are most likely going to loose your money.
About the best thing is to do one of two things, #1 don't use the
internet to buy stuff or do your banking or finances, or just to
practice safe hex which states to Never, Never Never give out your
Social Security number or pin or passwords to a site, and just
remember that your credit card company or bank ALREADY knows your
account number and or pin number and has no need to send you an email
or a link in an email to a web page that asks for your social security
number/account number/credit card number/pin because as I said earlier
they ALREADY have it.
+++++++++++++++++++++ END +++++++++++++++++++++++++++++
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
| Back to top |
|
 |
Fix your Windows Problems - FAST.
FREE Safe Scan Registry Check. Locate & Fix Errors in Minutes!
|
|
Fishface
Guest
|
| Posted: Sun Dec 14, 2003 12:35 am Post subject: Re: DANGEROUS new internet security hole |
|
|
T.R. wrote:
| Quote: | I came across this in another NG and thought I would share
it with the Gateway NG. I am Cutting and Pasting the whole
article below without any commentary from me.
|
Oh, that is so ugly, thanks for posting it.
I have to admit, though, I was initially very suspicious of your post. |
|
| Back to top |
|
|
T.R.
Guest
|
| Posted: Sun Dec 14, 2003 1:29 am Post subject: Re: DANGEROUS new internet security hole |
|
|
On Sat, 13 Dec 2003 10:35:40 -0800, "Fishface" <invalid@ddress.ok?>
wrote:
| Quote: | Oh, that is so ugly
|
Isn't it! Real Scary. Followups to the original posting in the other
NG says that this has been known for some time but MS has not made any
statements on it nor have they addressed it with a fix.
With this, some scumbag could copy an online store's website and make
you think you are shopping at the real store because the url shows as
being the real store and you give out your credit card info for
merchandize.
I think Bill Gates better get off his dead arse and address this since
I am reading that this has been going on for some time now.
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
| Back to top |
|
|
Fishface
Guest
|
| Posted: Sun Dec 14, 2003 1:40 am Post subject: Re: DANGEROUS new internet security hole |
|
|
T.R. wrote:
| Quote: |
With this, some scumbag could copy an online store's website and
make you think you are shopping at the real store because the url
shows as being the real store and you give out your credit card info
for merchandize.
|
Yeah, I was thinking about those eBay auctions I have paid for where
I was transferred to Paypal. I also envisioned an email purportedly
from a trusted online vendor, with a deal just too good to pass up.
They could spoof the whole transaction.
| Quote: | I think Bill Gates better get off his dead arse and address this since
I am reading that this has been going on for some time now.
|
Really. You'd think there would be a lot of bad press forcing the
hand of MS. I found this site: http://www.secunia.com/
There's lots of problems out there. Is it part of a diabloical plan to
induce users of especially older OS software to continually upgrade?!
Naa... |
|
| Back to top |
|
|
Ben Myers
Guest
|
| Posted: Sun Dec 14, 2003 2:06 am Post subject: Re: DANGEROUS new internet security hole |
|
|
Yes, very ugly indeed. I make it a habit of using Mozilla, not Internet
Explorer, for anything remotely resembling an on-line transaction.
I have also been the recipient of numerous emails claiming to be from eBay,
doing a routine audit, and asking me to verify my eBay account information. Of
course it is bogus! I reported it to eBay's fraud unit, who are well aware of
this scam, and essentially powerless to do something about it. My email
package, neither Outlook nor Outlook Express (!!!), tells me that the eBay scam
spam originated from an ISP in Russia. So there is nothing the US authorities
can do about spam from Russia, even if the so-called national anti-spam
legislation goes into effect. (BTW, the US anti-spam legislation passed by
Congress places limits on the states' anti-spam legislation, prohibiting actions
that are not permitted by the US law! Um, didn't our country have a lot of
arguments about states' rights, once upon a time?)
And have I talked about .NET and Microsoft Passport? Who wants to trust
Micro$oft with his or her personal and financial information?
.... Ben Myers
On Sat, 13 Dec 2003 10:35:40 -0800, "Fishface" <invalid@ddress.ok?> wrote:
| Quote: | T.R. wrote:
I came across this in another NG and thought I would share
it with the Gateway NG. I am Cutting and Pasting the whole
article below without any commentary from me.
Oh, that is so ugly, thanks for posting it.
I have to admit, though, I was initially very suspicious of your post.
|
|
|
| Back to top |
|
|
Fix your Windows Problems - FAST.
FREE Safe Scan Registry Check. Locate & Fix Errors in Minutes!
|
|
PWY
Guest
|
| Posted: Sun Dec 14, 2003 3:00 am Post subject: Re: DANGEROUS new internet security hole |
|
|
<ben_myers_spam_me_not @ charter.net (Ben Myers)> wrote in message
news:3fdb6fc6.24186357@news.charter.net...
| Quote: | Yes, very ugly indeed. I make it a habit of using Mozilla, not Internet
Explorer, for anything remotely resembling an on-line transaction.
I have also been the recipient of numerous emails claiming to be from
eBay,
doing a routine audit, and asking me to verify my eBay account
information. Of
course it is bogus! I reported it to eBay's fraud unit, who are well
aware of
this scam, and essentially powerless to do something about it. My email
package, neither Outlook nor Outlook Express (!!!), tells me that the eBay
scam
spam originated from an ISP in Russia. So there is nothing the US
authorities
can do about spam from Russia, even if the so-called national anti-spam
legislation goes into effect. (BTW, the US anti-spam legislation passed
by
Congress places limits on the states' anti-spam legislation, prohibiting
actions
that are not permitted by the US law! Um, didn't our country have a lot
of
arguments about states' rights, once upon a time?)
... Ben Myers
Yeah but you guys whupped us and effectively abolished state's rights |
except for taxation. |
|
| Back to top |
|
|
T.R.
Guest
|
| Posted: Sun Dec 14, 2003 4:14 am Post subject: Re: DANGEROUS new internet security hole |
|
|
Well I got an answer to my question about this where I said:
| Quote: | I think Bill Gates better get off his dead arse and address
this since I am reading that this has been going on for
some time now.
|
The answer came back that M$ has said:
"This is an abuse of a functionality and not a security hole"
So, I assume nothing will ever be done about it. But wait, wasn't all
the hoopla surrounding the "abuse of a functionality" in Messenger
addressed by M$ as a security problem? I mean, Messenger was not
broken, just being used improperly, right?
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
| Back to top |
|
|
Ben Myers
Guest
|
| Posted: Sun Dec 14, 2003 5:33 am Post subject: Re: DANGEROUS new internet security hole |
|
|
Huh??? You guys? Me? I don't do any whupping at all !!! Just maybe flog
Micro$soft and a few other name-brand companies when I think it is necessary...
Ben
On Sat, 13 Dec 2003 21:00:36 GMT, "PWY" <pyork22@*mail.com> wrote:
| Quote: |
ben_myers_spam_me_not @ charter.net (Ben Myers)> wrote in message
news:3fdb6fc6.24186357@news.charter.net...
Yes, very ugly indeed. I make it a habit of using Mozilla, not Internet
Explorer, for anything remotely resembling an on-line transaction.
I have also been the recipient of numerous emails claiming to be from
eBay,
doing a routine audit, and asking me to verify my eBay account
information. Of
course it is bogus! I reported it to eBay's fraud unit, who are well
aware of
this scam, and essentially powerless to do something about it. My email
package, neither Outlook nor Outlook Express (!!!), tells me that the eBay
scam
spam originated from an ISP in Russia. So there is nothing the US
authorities
can do about spam from Russia, even if the so-called national anti-spam
legislation goes into effect. (BTW, the US anti-spam legislation passed
by
Congress places limits on the states' anti-spam legislation, prohibiting
actions
that are not permitted by the US law! Um, didn't our country have a lot
of
arguments about states' rights, once upon a time?)
... Ben Myers
Yeah but you guys whupped us and effectively abolished state's rights
except for taxation.
|
|
|
| Back to top |
|
|
Ben Myers
Guest
|
| Posted: Sun Dec 14, 2003 5:37 am Post subject: Re: DANGEROUS new internet security hole |
|
|
"This is an abuse of a functionality and not a security hole."
What a wonderful copout. The same can be said for Java scripts, word and basic
macros, .NET, and Passport when used to infect a system with viruses, worms,
malware, spyware and the like.
Despite all the public posturing by Micro$oft, it seems that Bill Gates is an
Alfred E. Newman (remember him?) clone when it comes to security: "What? Me
worry?" ... Ben Myers
On Sat, 13 Dec 2003 22:14:11 GMT, T.R. <x@y.z> wrote:
| Quote: | Well I got an answer to my question about this where I said:
I think Bill Gates better get off his dead arse and address
this since I am reading that this has been going on for
some time now.
The answer came back that M$ has said:
"This is an abuse of a functionality and not a security hole"
So, I assume nothing will ever be done about it. But wait, wasn't all
the hoopla surrounding the "abuse of a functionality" in Messenger
addressed by M$ as a security problem? I mean, Messenger was not
broken, just being used improperly, right?
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
|
| Back to top |
|
|
Albert Alcoceba
Guest
|
| Posted: Sun Dec 14, 2003 2:02 pm Post subject: Re: DANGEROUS new internet security hole |
|
|
On Sat, 13 Dec 2003 23:37:04 GMT, ben_myers_spam_me_not @ charter.net
(Ben Myers) wrote:
| Quote: | "This is an abuse of a functionality and not a security hole."
What a wonderful copout. The same can be said for Java scripts, word and basic
macros, .NET, and Passport when used to infect a system with viruses, worms,
malware, spyware and the like.
|
Yup and that method is a kludge that can easily be seen by clicking
file/properties on the web page as well as watching the status bar as
the page loads. *yawn*.
Albert Alcoceba
<><
alberta@REMOVE.ihug.com.au
http://www.racysrailway.com/
Remove REMOVE |
|
| Back to top |
|
|
Fix your Windows Problems - FAST.
FREE Safe Scan Registry Check. Locate & Fix Errors in Minutes!
|
|
PWY
Guest
|
| Posted: Sun Dec 14, 2003 10:23 pm Post subject: Re: DANGEROUS new internet security hole |
|
|
Ben
In the south, a reference to " state's rights " still brings to mind the
Civil War.
Sorry, just an attempt at humor.
<ben_myers_spam_me_not @ charter.net (Ben Myers)> wrote in message
news:3fdba198.2196638@news.charter.net...
| Quote: | Huh??? You guys? Me? I don't do any whupping at all !!! Just maybe
flog
Micro$soft and a few other name-brand companies when I think it is
necessary...
Ben
On Sat, 13 Dec 2003 21:00:36 GMT, "PWY" <pyork22@*mail.com> wrote:
ben_myers_spam_me_not @ charter.net (Ben Myers)> wrote in message
news:3fdb6fc6.24186357@news.charter.net...
Yes, very ugly indeed. I make it a habit of using Mozilla, not
Internet
Explorer, for anything remotely resembling an on-line transaction.
I have also been the recipient of numerous emails claiming to be from
eBay,
doing a routine audit, and asking me to verify my eBay account
information. Of
course it is bogus! I reported it to eBay's fraud unit, who are well
aware of
this scam, and essentially powerless to do something about it. My
email
package, neither Outlook nor Outlook Express (!!!), tells me that the
eBay
scam
spam originated from an ISP in Russia. So there is nothing the US
authorities
can do about spam from Russia, even if the so-called national anti-spam
legislation goes into effect. (BTW, the US anti-spam legislation
passed
by
Congress places limits on the states' anti-spam legislation,
prohibiting
actions
that are not permitted by the US law! Um, didn't our country have a
lot
of
arguments about states' rights, once upon a time?)
... Ben Myers
Yeah but you guys whupped us and effectively abolished state's rights
except for taxation.
|
|
|
| Back to top |
|
|
Jupiter Jones
Guest
|
| Posted: Mon Dec 15, 2003 6:39 am Post subject: Re: DANGEROUS new internet security hole |
|
|
And Microsoft has just published a Knowledge Base article about this
yesterday:
http://www3.telus.net/dandemar/decweb.htm
This has been getting a lot of attention in some of the Microsoft
newsgroups in the last few weeks.
--
Jupiter Jones
Check the following link for some great problem solving newsgroups.
http://support.microsoft.com/newsgroups/default.aspx
http://dts-l.org/index.html
"T.R." <x@y.z> wrote in message
news:pugmtvgqv8sqtut7k30umas5ovjgl6r86v@4ax.com...
| Quote: | I came across this in another NG and thought I would share it with
the
Gateway NG. I am Cutting and Pasting the whole article below
without
any commentary from me.
++++++++++++++++++++++ START ++++++++++++++++++++++++
DANGEROUS new internet security hole
Well ok maybe not all that new; but in this configeration it may
just
well be new:
The bad guys have now found a new way to make you think you are at a
different web page then what you really are. It use to be if you
clicked on a link even the old type of fake URL you could still tell
where it sent you by looking at the address bar of your web browser
(IE). Now however there is a new way in which you can click on a
link
that says it is a Microsoft link and when you get to the page
instead
of the web browsers address bar saying where you actually are
instead
using this new bug/hole the address bar can say anything they like.
To see a harmless example go here:
http://dino-soft.org/security/vun1.html
To see several different ones go here after going to the above. The
pages the below link take you to only have text telling you about
it;
but the above has a Microsoft banner to make it look more real:
http://dino-soft.org/security/newurlhole.html
With this as with other security holes it goes to show that unless
you
actually type in the address you are not sure you are going to where
the link points. Even when you do type in the URL address into the
address bar, if the page is a malicious page it could make it's self
look like anything it wants. Like maybe sending you an official
looking email from your credit card company or bank or what ever and
then when you go there it looks for all the world like it is
legitimate; but it isn't and if you give up your account number and
or
pin number you are most likely going to loose your money.
About the best thing is to do one of two things, #1 don't use the
internet to buy stuff or do your banking or finances, or just to
practice safe hex which states to Never, Never Never give out your
Social Security number or pin or passwords to a site, and just
remember that your credit card company or bank ALREADY knows your
account number and or pin number and has no need to send you an
email
or a link in an email to a web page that asks for your social
security
number/account number/credit card number/pin because as I said
earlier
they ALREADY have it.
+++++++++++++++++++++ END +++++++++++++++++++++++++++++
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
|
| Back to top |
|
|
Fishface
Guest
|
| Posted: Mon Dec 15, 2003 7:24 am Post subject: Re: DANGEROUS new internet security hole |
|
|
Jupiter Jones wrote:
| Quote: | And Microsoft has just published a Knowledge Base article
about this yesterday:
|
I see a link on the MS home page to:
http://www.microsoft.com/security/incident/spoof.asp
....at least I *think* it was the Microsoft's website!  |
|
| Back to top |
|
|
T.R.
Guest
|
| Posted: Mon Dec 15, 2003 7:25 am Post subject: Re: DANGEROUS new internet security hole |
|
|
On Mon, 15 Dec 2003 00:39:35 GMT, "Jupiter Jones"
<jones_jupiter@hotnomail.com> wrote:
| Quote: | And Microsoft has just published a Knowledge Base article about this
yesterday: http://www3.telus.net/dandemar/decweb.htm
This has been getting a lot of attention in some of the Microsoft
newsgroups in the last few weeks.
|
Thanks for the info Jupiter. I'm glad to see they are finally getting
on board with this. I know that when I did the test site on this that
I was given no indication in the Status bar, Address bar or Title bar
of the true URL identity and with running broadband, the pages load so
quick that whatever is being displayed in the status bar during page
loading as to where you are being directed go flashed by in a fraction
of a second not given time to notice if that was different than the
link name (might have been able to see it on slow [*yawn* type] dialup
but not 5000 Kbsp broadband).
I see from reading the link you provided that M$ is telling people how
to watch out for this but they don't seem to be indicating that they
are going to disable this "Feature" being abused.
Thanks again for the link....
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
| Back to top |
|
|
Jupiter Jones
Guest
|
| Posted: Mon Dec 15, 2003 9:22 am Post subject: Re: DANGEROUS new internet security hole |
|
|
Thomas;
Whether anything more can or will be done is anybody's guess, at least
the information is getting out there to at least some people.
--
Jupiter Jones
Check the following link for some great problem solving newsgroups.
http://support.microsoft.com/newsgroups/default.aspx
http://dts-l.org/index.html
"T.R." <x@y.z> wrote in message
news:ob3qtv440s5pu6o06ijtu3ihujin97brhq@4ax.com...
| Quote: | Thanks for the info Jupiter. I'm glad to see they are finally
getting
on board with this. I know that when I did the test site on this
that
I was given no indication in the Status bar, Address bar or Title
bar
of the true URL identity and with running broadband, the pages load
so
quick that whatever is being displayed in the status bar during page
loading as to where you are being directed go flashed by in a
fraction
of a second not given time to notice if that was different than the
link name (might have been able to see it on slow [*yawn* type]
dialup
but not 5000 Kbsp broadband).
I see from reading the link you provided that M$ is telling people
how
to watch out for this but they don't seem to be indicating that they
are going to disable this "Feature" being abused.
Thanks again for the link....
Regards,
Thomas
Communists: Liberals who know what they're doing! |
|
|
| Back to top |
|
|
|
|
|
|
| |
Watched Topics
Search
Register
Log in to check your private messages
Profile
Log in
Memberlist
Usergroups