HACKED

[j.w]

Microsoft just released a bombshell security announcement. Researchers at security company FireEye have found a flaw in Internet Explorer that could let hackers easily slip a virus on to your computer. And hackers are already using it.

This flaw is present in every version of Internet Explorer – from 6 to 11 – stretching back more than a decade.

You have no defense with the latest Windows systems, either; the program is vulnerable no matter which version of Windows you are running.

The bug is a drive-by hack; all you have to do is visit a site that hackers have hijacked or modified and you’re infected.

The bad news: As I’m writing this, there’s no permanent fix and Microsoft is still researching the problem.

Updated 4/28 at 1:30 p.m.: A fix for one part of the problem is available from Adobe. Read on to learn more.
http://www.komando.com/tips/250386/...-affects-every-version-of-internet-explorer/2

 

[Dave 54]

Thanx for the heads up j.w. I'll tell our IT man Jon about your findings

Dave

 

[JBtheExplorer]

I use Chrome but do rarely use IE.
My guess is that everything we use can be hacked no matter how secure they think it is. There will always be a loophole of some sort as long as technology is involved.

 

[Waterbug]

I wouldn't get too excited. Getting software on to people's computes is super easy today. People download all kinds of stuff without a clue of what's actually delivered.

These kinds of security problems are always being found. This one is more than 10 years old and suddenly today it's a threat???

The real threat today imo are all the threat warnings. Far more time is lost on these than actual problems.

 

[j.w]

They sure are making a big deal out of it for nothing then. I don't use I.E myself. Been using Firefox for years. No hack problems for me yet. I do use all the computer protection I can tho. Keep it all updated and stay away from sites that I am warned about being unscrupulous. Even the feds are warning:

Don't use IE: Government issues major warning over Internet Explorer bug and says hackers are ALREADY exploiting it

Read more: http://www.dailymail.co.uk/sciencet...kers-ALREADY-exploiting-it.html#ixzz30EFMVMOS

 

[Waterbug]

I kind of hate to be a wet blanket on the drama machine that is the internet but here's a link to the the US government actually said. On the same site you can read hundreds of such warnings on all kinds of software.

One "news" web site decided to spice up the report saying the gov wants everyone to stop using IE and hundreds of other "news" web sites then rewrote the story and linked to other bogus stories.

That is the virus as in "going viral". We used to have to write actual computer code to disrupt the world. That is no longer needed. Anyone can create a virus by just making up some wild story and it spreads across world much, much faster than the old code based viruses ever did. You are infected every time you read these "news" stories and spread the word.

Not to worry...tomorrow there will be a whole new batch of unbelievable stories to scare us.

Pretty cool we live in a time when we have nothing better to do.

 

[j.w]

Well then I just wish they would knock it off and stop scaring us for nothing. If it's not hacking it's some disease going around that is gonna kill us right out flat at any moment.

 

[Waterbug]

There is one sure way to stop it...just stop.

Where did you hear the hyped story? Well, consider getting mad at that source and stop listening to it. It's a waste of time. Keep doing that and pretty soon you'll be hearing a lot less crap.

We're surrounded by an amazing amount of crap. Thousands of web sites writing whatever crap they can dream up to get a few more people to their web site to get a few pennies in ads. We have several 24 hour "news" channels that fill the air with stuff they make up to get people to watch. What were once respected newspaper now owned by billionaires who are now allowed to also own radio and TV in the same market so they can pushed any made up story they like to earn more money to get more power. That wasn't allowed a little while ago.

And of course by far the biggest source of crap...people on the internet. They enable the viral crap machine.

None of the crap peddlers ever pay a price for lies. Instead we demand even more crap. We love crap. But people do have the option to opt out.

We're entering a new era. Who knows where it'll end up. Personally I'm OK with all this. It's the wild, wild west again. Anything goes. Tons of things that were illegal just a few years ago (10-15) are now not only legal but considered moral. As long as people are fed things like Candy Crush and cool iPhones they seem to be more than willing to give up many of their freedoms. That creates a lot of opportunity. We live at a great time. Makes the days of the Robber Barons look like Sunday school.

 

[callingcolleen1]

Oh Great, another thing to worry about!

 

[Big Lou]

I use Chrome. Very user friendly. Give it a try.

 

[j.w]

I like Firefox. IE always seems to be the target for everything. Poor Microsoft!

This is all over the news here and they are saying it has been going on for 10yrs but now they are just getting serious about it.

Don't spend time worrying about it. Just switch to another browser till they fix it.

The exploit – which is a fundamental problem in Internet Explorer – takes advantage of a known vulnerability in Adobe Flash. In other words, in order to attack you using Internet Explorer, malware needs to go through Flash.

Adobe has now released an emergency security update to block this hole. To be clear, Flash is being patched across all browsers and platforms, including Mac, Linux and Chrome.

SAN FRANCISCO — The U.S. Department of Homeland security is advising Americans not to use the Internet Explorer Web browser until a fix is found for a serious security flaw that came to light over the weekend.

The bug was announced on Saturday by FireEye Research Labs, an Internet security software company based in Milpitas, Calif.

"We are currently unaware of a practical solution to this problem," Will Dormann at the CERT division of the Software Engineering Institute at Carnegie Mellon University in Pittsburgh, wrote on Monday.

It recommended that users and administrators "consider employing an alternative Web browser until an official update is available."

The security flaw allows malicious hackers to get around security protections in the Windows operating system. They then can be infected when visiting a compromised website.

Because the hack uses a corrupted Adobe Flash file to attack the victim's computer, users can avoid it by turning off Adobe Flash.

"The attack will not work without Adobe Flash," FireEye said. "Disabling the Flash plugin within IE will prevent the exploit from functioning."

While the bug affects all versions of Internet Explorer 6 through 11 it is currently targeting IE9 and IE10, FireEye stated.

The attacks do not appear to be widespread at this time. Microsoft said it was "aware of limited, targeted attacks that attempt to exploit" the vulnerability.

These are called "watering-hole attacks," said Satnam Narang, a threat researcher with computer security company Symantec in Mountain View, Calif.

Rather than directly reach out to a victim, the hackers inject their code into a "normal, everyday website" that the victim visits, he said. Code hidden on the site then infects their computers.

"It's called a watering-hole attack because if you're a lion, you go to the watering hole because you know that's where the animals go to drink."

FireEye said the hackers exploiting the bug are calling their campaign "Operation Clandestine Fox."

Microsoft confirmed Saturday that it is working to fix the code that allows Internet Explorer versions 6 through 11 to be exploited by the vulnerability. As of Monday morning, no fix had been posted.

Microsoft typically releases security patches on the second Tuesday of each month, what's known as Patch Tuesday. The next one is Tuesday, May 14. Whether the company will release a patch for this vulnerability before that isn't known.

About 55% of PC computers run one of those versions of Internet Explorer, according to the technology research firm NetMarketShare. About 25% run either IE9 or IE10.

Computer users who are running the Windows XP operating system are out of luck. Microsoft discontinued support of the system on April 8.

Symantec is offering XP users tools to protect themselves, which it has made available on its blog.

 

[addy1]

Thanks jw, I use just firefox and have only used it for many years. Better safe than sorry is my opinion. They had it on the news here too.
My one xp computer, that is running, is just used as a server for our phone and weather station, so no websites visited and it also has only firefox loaded on it

 

[VanDiesil]

100% agreement with Waterbug. I have worked in IT security for the past 20 years or so and exploits are discovered every single day that have been open for ages and been exploited for just as long before they get "reported" on. The media gives out "advice" which is just as bad as the exploits themselves! Heartbleed is one such recent issue that was long "undiscovered" and the "advice" to change your passwords immediately was the worst thing to do as if the sites that the passwords were for had not been "patched", then you run the risk of giving any "intruders" your new details rendering what may have been nothing to worry about in to something that has compromised your online safety!

Lets not also forget that simply using a different web browser does not render you safe. If you use ANY version of Windows past Windows 98, IE has been heavily embedded in to the operating system itself and not able to be removed without corrupting several required system files and breaking library links between other files.. This has been the case since IE4 from memory! This was also part of Microsoft's defence regarding a lawsuit over the inclusion of IE with the operating system (which ended with a "choose a different browser" update added to Windows Update so users that may not have been aware of alternative browsers could make their own minds up. Because of the heavy integration, should a rogue non-Active-X exploit be picked up by browsing with a non-IE browser, then the machine is compromised still. Safari on the Mac OS has a lot of unpatched exploits, but because the user base is still lower than IE, it is not worth the "criminals" targetting it. There are Mac OS infections out there (not viruses as there has been no new TRUE computer virus found in the wild for over a decade!) in the way of malware, but these are few and far between because of the limited user base & nothing to do with security.

I use ALL major Windows browsers on a daily basis (IE, Chrome, Firefox and Opera) and my machines are 100% clean, simply because I don't visit sites that will attract the attention of the "criminals". Using Ad-Blocking software and at router blocking level, helps in a bigger way than not using a browser because the media is making a mountain out of a molehill.

 

[addy1]

I just like firefox always have, never cared for ie.

Good thing criminals don't like pond forums.................

 

[HARO]

I like Firefox. IE always seems to be the target for everything. Poor Microsoft!


































Microsoft typically releases security patches on the second Tuesday of each month, what's known as Patch Tuesday. The next one is Tuesday, May 14. Whether the company will release a patch for this vulnerability before that isn't known.





.

Tuesday, May 14 of what year?
John