Urgent warning

[ciphergoth]

Stop browsing the web NOW, or your computer will come under the control of the Bad Guys. Read this first.

Internet Explorer, the web browser that comes bundled with Windows and some Mac systems, has a serious security flaw. Just by viewing a web page you might compromise your machine. And thousands of web pages all over the Net contain the damaging code - because the machines hosting those pages have been compromised. This means that you will be attacked even if you stick to browsing sites that you trust.

There is no fix to Internet Explorer available, even though this flaw has been known about for some time. If you continue to use this browser, you are asking the bad guys to control your computer. They will use it for things like sending spam and compromising your bank details and personal information.

Currently the only fix is to install another browser. Even if Microsoft get around to fixing this problem, the history shows that there will be many others, and that your computer will be open to takeover by others for as long as you use Internet Explorer.

If your workplace forbid you from installing software on your machine, you have three choices:

1. Never browse the Web from your work computer - just don't start the browser at all, ever.
2. Disobey your work and install another browser.
3. Disobey your work and install a program for sending spam, involuntarily, courtesy of the Bad Guys.

Please don't choose option 3.

I recommend installing Mozilla Firefox right away. Others prefer other browsers - pretty much any alternative to Internet Explorer will be better.

More details in reddragdiva's journal. But maybe install a new browser first, and then go browsing later?

Comments

The Great Anti-virus Stop-Gap Solution (but it's better than nothing, right?)

[bondagewoodelf.livejournal.com]

I know it's a stop-gap. But fortunately there are several anti-virus companies that have already released an update to handle the thing that it on the loose on, alledgedly, all those web sites.

I just checked, and my own preference, Kaspersky AV has it in the 2004-06-25 update.

Of course this might only protect against this particular instance of the exploit and not against the vulnerability itself (or maybe it does? they might have added some generic fix for this particular one, although I doubt it since it's listed as 'Trojan.JS.Scob.a' which looks like a very specific detection.

Of course:

- I do most of my browsing with Opera anyway
- AV definitions at corporate sites are often horribly old

Other companies (Symantec, Computer Associates and F-Secure) appear to have AV definitions for this one already as well.

Re: The Great Anti-virus Stop-Gap Solution (but it's better than nothing, right?)

[skx.livejournal.com]

The problem with virus scanners for things like this is that it's a very reactive thing to do, not proactive.

Most of the recent I.E. flaws have been minor things in themselves, and only become dangerous when combined together. This means it's a safe bet something slightly different will arrise sone and you'll be just as vulnerable.

It's these flaws which allow the trojan to be installed.

Next time a similar flaw could install a different program and your scanner may not know about it.

Re: The Great Anti-virus Stop-Gap Solution (but it's better than nothing, right?)

[bondagewoodelf.livejournal.com]

Yeah, that's what I meant with that the scanner is too specific.

I hope there's a fix for IE6 soon. Some sites I visit regularly don't work properly with Opera *sigh*

Re: The Great Anti-virus Stop-Gap Solution (but it's better than nothing, right?)

[pavlos.livejournal.com]

The problem with virus scanners for things like this is that it's a very reactive thing to do, not proactive.

I agree using IE and a virus scanner is like not using condoms but religiously having STD tests - an approach only useful within closed environments.