Internet Explorer. Quick, call security!

The Redmond Butterfly Effect

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

Opinion Most of you have heard of a reportedly widespread compromise of an unknown number of clients through an unpatched vulnerability in Internet Explorer. The clients were owned by visiting commercial websites that had previously been compromised by a yet undetermined method; the attackers dropping code onto those servers that customers would then launch when the site was visited.

While some speculate that an IIS zero day was used to own the servers, my guess is that the hosting boxes were not patched against a recent vulnerability (something like MS04-11). I would normally say "Hey, you should have been patched" and gone about my business. But this event is a bit different.

Here we had multiple vulnerabilities in IE, at least one spanning back months, which have remained unpatched by Microsoft. The culmination of the vulnerabilities allows for silent code execution on the client box: zones crossed, files downloaded, code executed, boxes owned. Microsoft's own little butterfly effect.

To be quite frank, this really, really sucks.

This event perfectly illustrates points that we in the security community have been making for quite some time - attacks are getting more and more complex, and attackers are using multiple vulnerabilities to carry them out. It also represents what I consider a flaw in the way the IE security team looks at and rates vulnerabilities. The "mitigating factors" in these vulnerabilities have always been determined by looking at the problems in singularity. Things like "an attacker would have to be able to write files locally" or "this would only work if code was run in the Local Intranet Zone."

When Microsoft then uses these factors to schedule hot fix development and deployment, we find ourselves in the position we're in today: insufficient ranking is given to these vulnerabilities, attackers piggyback exploits together - leveraging one against the other to fully compromise a machine - and here we are sitting around with no patch available.

We shouldn't be meeting today with our admins discussing "work-arounds," we should be following up on how the patch rollout went.

Microsoft's tunnel vision

The combination of compromised servers in this scenario also breaks the old "one would have to be coaxed into visiting a malicious website" factor. There is no "coaxing" here. To fall prey to this attack, you would simply have to use IE the way we've been told to use IE - to look in on your Abba collection on eBay or check your Yahoo mail account. And users sitting behind a corporate firewall with AV running client-side would have fared no better.

The fact that XP's SP2 would have fixed this problem is nice to know, but it really doesn't help us much today. To be honest, I'm a little miffed at the fact that Microsoft was familiar enough with these issues to address them in a service pack beta, yet no patch was made available for our production systems.

Internet Explorer is an extremely complex work. I'm not really all that sure what to call it: Application? Browser? Development platform? Mini-OS? Given the innate complexity of zone settings, ActiveX object controls and the various scripting configurations, there is really no excuse for the way multiple vulnerabilities within a single product were handled with such tunnel vision, particularly when their combined exploitation has been exemplified on forums like Security Focus for months now.

I've been watching IE grow for years now, and while I'm aware of the tremendous effort put forth to make it a platform from which elaborate corporate development projects can be built, one has to question the need for such complexity in what most of us use as a Web browser.

Maybe it is time for an "Enterprise Edition" of IE to be developed in the same way that Microsoft has developed expanded capabilities into other products like Visual Studio and Visio. That way, those who need a complex development platform can have it, and the rest of us can have a nice, tight little browser to do with as we will. When it comes to my browser, it would be nice to be able to concentrate on Adriana Lima without having to worry about the likes of Adrian Lamo.

Regardless of what the future of IE brings, it is evident to me that given the events of today the IE security team either doesn't fully understand the security ramifications of its product, or the thing is so complex that it really does take over 10 months to patch a bug. Either way, it doesn't look so good.

Copyright © 2004, SecurityFocus logo

SecurityFocus columnist Timothy M. Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software. AnchorIS.Com also provides security consulting services for a variety of companies, including Microsoft Corporation.

Related stories

Gates defends Microsoft patch efforts
CERT recommends anything but IE
Watch out! Incoming mass hack attack
Unpatched IE vuln exploited by adware
MS hatches June patch batch

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story


Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.