Major flaw revealed in Internet Explorer; users urged to switch

**Terminator** · 12-17-08, 02:07 AM

The major press outlets are abuzz this morning with news of a major new security flaw that affects all versions of Internet Explorer from IE5 to the latest beta of IE8. The attack has serious and far-reaching ramifications -- and they're not just theoretical attacks. In fact, the flaw is already in wide use as a tool to steal online game passwords, with some 10,000 websites infected with the code needed to take advantage of the hole in IE.Virtually all security experts (as well as myself) are counseling users to switch to any other web browser -- none of the others are affected, including Firefox, Chrome, and Opera -- at least for the time being, though Microsoft has stubbornly said it "cannot recommend people switch due to this one flaw." Microsoft adds that it is working on a fix but has offered no ETA on when that might happen. Meanwhile it offers some suggestions for a temporary patch, including setting your Internet security zone settings to "high" and offering some complicated workarounds. (Some reports state, however, that the fixes do not actually work.)
Expedient patching or switching are essential. Security pros fear that the attack will soon spread beyond the theft of gaming passwords and into more criminal arenas, as the malicious code can be placed on any website and can be adapted to steal any password stored or entered using the browser. It's now down to the issue of time: Will Microsoft repair the problem and distribute a patch quickly enough to head off the tsunami of fraud that's about to hit or will it come too late to do any good?
Meanwhile, I'll reiterate my recommendation: Switch from Internet Explorer as soon as you can. You can always switch back once the threat is eliminated. (To clarify: You don't need to uninstall IE, just don't use it for the time being.)

Links for other browsers to try: Firefox Chrome Safari Opera

**Second Chance** · 12-17-08, 08:47 AM

I stopped using I.E. after I got Vista, it seems to crash all the time. I am currently running Firefox browser, but I might try Opera 9.6...................

**lewisipso** · 12-17-08, 09:05 AM

Safari seems to be working for me. Read about this, this a.m.

**Jenna** · 12-17-08, 09:07 AM

I usually use Firefox anyway. Internet Explorer tends to be slow and buggy.

**10-42Adam** · 12-17-08, 10:16 AM

Glad I use Firefox then, but I guess I'll urge my girlfriend and family to switch...

**Odd** · 12-17-08, 10:36 AM

Whichever browser you prefer, now would be a good time make sure you have the latest version. If you don't have automatic updates on, run Windows Update for patchy goodness too.

**MacLean** · 12-17-08, 12:39 PM

http://www.microsoft.com/technet/sec...ry/961051.mspx

Anyone who is using IE can find the workaround at the above link, and the patch will be out in 20 minutes or so.

**MacLean** · 12-17-08, 01:22 PM

Patch is out:

http://www.microsoft.com/technet/sec.../ms08-078.mspx

**irishmick** · 12-17-08, 01:31 PM

I use Firefox anyway. Though, I'll download the patch just to be safe. Sometimes people use my IE.

**MacLean** · 12-17-08, 01:41 PM

You should always patch all of your software, even if you don't use it.

In 2007, Firefox users with IE were exposed to a vulnerability which was potentially devastating.

**irishmick** · 12-17-08, 01:43 PM

Good to know!

**MacLean** · 12-17-08, 01:44 PM

It goes back and forth - there is no browser that someone won't find a flaw in.

This was a bonehead miss on Microsoft's part, but they fixed it fast.

**Terminator** · 12-17-08, 08:09 PM

We use IE7 at work, and we were sent an alert notice about this, with a link to the patch. We were told to take some extra precautions (before the patch was released), but the rule nazi's warned us not to install Firefox. LOL.

**Rhino** · 12-17-08, 09:23 PM

Originally Posted by maclean

Patch is out:

http://www.microsoft.com/technet/sec.../ms08-078.mspx

borken

**pc830cop** · 12-17-08, 09:29 PM

Another reason why I'm a Mac person.

**MacLean** · 12-17-08, 11:12 PM

Originally Posted by Rhino

borken

Works fine.

**MacLean** · 12-17-08, 11:13 PM

Originally Posted by pc830cop

Another reason why I'm a Mac person.

Right, because Macs never have these issues.

**Terminator** · 12-17-08, 11:16 PM

Originally Posted by maclean

Right, because Macs never have these issues.

Select * from OfficerResource.siteusers
Where clue > 0

0 Rows Returned

**MacLean** · 12-17-08, 11:17 PM

Originally Posted by Terminator

We use IE7 at work, and we were sent an alert notice about this, with a link to the patch. We were told to take some extra precautions (before the patch was released), but the rule nazi's warned us not to install Firefox. LOL.

Rule nazis are typically stoopid - no matter which browser they use.

We are lucky at work now, we have good rule nazis who trust those of us - two of us - who know what we are doing.

**pgg** · 12-18-08, 03:16 AM

Okay, I opened up the webpage for the patch. How in the hell do I know what version I have and what I need to download? Keep in mind I have problems turning the computer on