Feeds

Internet Explorer. Quick, call security!

The Redmond Butterfly Effect

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Opinion Most of you have heard of a reportedly widespread compromise of an unknown number of clients through an unpatched vulnerability in Internet Explorer. The clients were owned by visiting commercial websites that had previously been compromised by a yet undetermined method; the attackers dropping code onto those servers that customers would then launch when the site was visited.

While some speculate that an IIS zero day was used to own the servers, my guess is that the hosting boxes were not patched against a recent vulnerability (something like MS04-11). I would normally say "Hey, you should have been patched" and gone about my business. But this event is a bit different.

Here we had multiple vulnerabilities in IE, at least one spanning back months, which have remained unpatched by Microsoft. The culmination of the vulnerabilities allows for silent code execution on the client box: zones crossed, files downloaded, code executed, boxes owned. Microsoft's own little butterfly effect.

To be quite frank, this really, really sucks.

This event perfectly illustrates points that we in the security community have been making for quite some time - attacks are getting more and more complex, and attackers are using multiple vulnerabilities to carry them out. It also represents what I consider a flaw in the way the IE security team looks at and rates vulnerabilities. The "mitigating factors" in these vulnerabilities have always been determined by looking at the problems in singularity. Things like "an attacker would have to be able to write files locally" or "this would only work if code was run in the Local Intranet Zone."

When Microsoft then uses these factors to schedule hot fix development and deployment, we find ourselves in the position we're in today: insufficient ranking is given to these vulnerabilities, attackers piggyback exploits together - leveraging one against the other to fully compromise a machine - and here we are sitting around with no patch available.

We shouldn't be meeting today with our admins discussing "work-arounds," we should be following up on how the patch rollout went.

Microsoft's tunnel vision

The combination of compromised servers in this scenario also breaks the old "one would have to be coaxed into visiting a malicious website" factor. There is no "coaxing" here. To fall prey to this attack, you would simply have to use IE the way we've been told to use IE - to look in on your Abba collection on eBay or check your Yahoo mail account. And users sitting behind a corporate firewall with AV running client-side would have fared no better.

The fact that XP's SP2 would have fixed this problem is nice to know, but it really doesn't help us much today. To be honest, I'm a little miffed at the fact that Microsoft was familiar enough with these issues to address them in a service pack beta, yet no patch was made available for our production systems.

Internet Explorer is an extremely complex work. I'm not really all that sure what to call it: Application? Browser? Development platform? Mini-OS? Given the innate complexity of zone settings, ActiveX object controls and the various scripting configurations, there is really no excuse for the way multiple vulnerabilities within a single product were handled with such tunnel vision, particularly when their combined exploitation has been exemplified on forums like Security Focus for months now.

I've been watching IE grow for years now, and while I'm aware of the tremendous effort put forth to make it a platform from which elaborate corporate development projects can be built, one has to question the need for such complexity in what most of us use as a Web browser.

Maybe it is time for an "Enterprise Edition" of IE to be developed in the same way that Microsoft has developed expanded capabilities into other products like Visual Studio and Visio. That way, those who need a complex development platform can have it, and the rest of us can have a nice, tight little browser to do with as we will. When it comes to my browser, it would be nice to be able to concentrate on Adriana Lima without having to worry about the likes of Adrian Lamo.

Regardless of what the future of IE brings, it is evident to me that given the events of today the IE security team either doesn't fully understand the security ramifications of its product, or the thing is so complex that it really does take over 10 months to patch a bug. Either way, it doesn't look so good.

Copyright © 2004, SecurityFocus logo

SecurityFocus columnist Timothy M. Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software. AnchorIS.Com also provides security consulting services for a variety of companies, including Microsoft Corporation.

Related stories

Gates defends Microsoft patch efforts
CERT recommends anything but IE
Watch out! Incoming mass hack attack
Unpatched IE vuln exploited by adware
MS hatches June patch batch

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.