• Nick Wang
  • 2 min read

IE 5 to 8 major security flaw gives your passwords away

I don’t remember how many years it has been since I ditched IE, and since last year I’ve migrated to Mac 100%. Wouldn’t it be nice if no one uses IE anymore? We definitely need to spread the news on this one!

Major flaw revealed in Internet Explorer; users urged to switch

http://tech.yahoo.com/blogs/null/111811 The major press outlets are abuzz this morning with news of a major new security flaw that affects all versions of Internet Explorer from IE5 to the latest beta of IE8. The attack has serious and far-reaching ramifications – and they’re not just theoretical attacks. In fact, the flaw is already in wide use as a tool to steal online game passwords, with some 10,000 websites infected with the code needed to take advantage of the hole in IE. Virtually all security experts (as well as myself) are counseling users to switch to any other web browser – none of the others are affected, including Firefox, Chrome, and Opera – at least for the time being, though Microsoft has stubbornly said it “cannot recommend people switch due to this one flaw.” Microsoft adds that it is working on a fix but has offered no ETA on when that might happen. Meanwhile it offers some suggestions for a temporary patch, including setting your Internet security zone settings to “high” and offering some complicated workarounds. (Some reports state, however, that the fixes do not actually work.) Expedient patching or switching are essential. Security pros fear that the attack will soon spread beyond the theft of gaming passwords and into more criminal arenas, as the malicious code can be placed on any website and can be adapted to steal any password stored or entered using the browser. It’s now down to the issue of time: Will Microsoft repair the problem and distribute a patch quickly enough to head off the tsunami of fraud that’s about to hit or will it come too late to do any good? Meanwhile, I’ll reiterate my recommendation: Switch from Internet Explorer as soon as you can. You can always switch back once the threat is eliminated. (To clarify: You don’t need to uninstall IE, just don’t use it for the time being.) Links for other browsers to try: Firefox Chrome Safari Opera

Comments

adamsmith1922 — 2008-12-17 17:10:46

Suggest people switch to Firefox http://adamsmith.wordpress.com/2008/12/17/security-flaw/

Related Posts

· 4 min read

Making Toys Vs. Developing Software - Agile Hong Kong

Toys vs. Software - Agile Hong Kong (by cloneofsnake) I almost missed Tuesday night’s Agile Hong Kong event - Toys vs. Software, Fight! Had to check the address and the map at a public terminal in MTR at the last minute! Jonathan Buford, Managing and Technical Director at Advanced Design Labs, was there to talk about his experience in the toys development process… and how it’s similar / different from software development. He showed us a few of his past designs, one of which I’ve seen on TV commercials in the US. He also has a product that has just finished development and is being manufactured for the coming Chirstmas season. It was pretty interesting to learn about the specifics in creating new toys. In fact, it was so interesting that we kept asking questions about making toys and Jonathan had to ditched the entire 2nd half of his speech on software development! :) This shouldn’t be surprising, as most of the people attending Agile’s events should have IT backgrounds and understand software development processes and project management. So we all had a good grasp on Jonathan’s explanation on the “critical path” in product development. What really interested me was about the risks - R&D can completely go down the tube if no one is buying the idea. So, to minimize risk, they develop lots and create prototypes quickly. He mentioned Rapid Prototyping machines, saying that eventually users will be able to design and make the prototypes themselves. This is related to crowdsourcing and Cuusoo.com, so I asked him what was his take on “crowdsourcing toys design”. Jonathan thinks that we are heading toward the direction of “user generated products”, there are just 2 factors holding us back - 1) the design tools that Jonathan uses is quite advanced and the general public just don’t have the kind of access to these tools. He mentioned that Google SketchUp is pretty good, and may be some day soon, people can use that to design & make models. 2) is the manufacturing part - how do normal people connect to manufacturers? Obviously, he doesn’t know about Cuusoo.com, it has the entire 2nd part covered! I have heard about SketchUp when it was first bought by Google, I guess it is time for me to pay a visit and see if we can integrate its tools for crowdsourcing design.

Read More

· 4 min read

BarCamp Hong Kong 2008

Startup Lighting Talks (by 黛) Comrades at Hong Kong’s Drupal group reminded me about BarCamp Hong Kong 2008, it was my first time and I got a really good impression of it. It’s probably fair to say I won’t be the only one who wishes we can have BarCamps more often. I loved it! Check out all the photos at flickr and a general write up about it on LaiHiu’s blog and another insightful one at Ca Phun Ung’s yelotofu. Personally, it felt great to be able to immerse once again in an open, knowledge-sharing environment. We have lots of these events in the US, and they are great for networking. I was able to meet with a few great people and also organized more regular offline meetings after BarCamp. I listened to iPhone apps development (& finding it more and more amazing how Apple can become so popular and “cool” while maintaining their unfriendly, “closed door” stance.) An Open Education open-mic with John Britton (half of it), then jumped over to Microsoft’s OSS session. The lead developer of one of the best online Rich Text Editor - FCKeditor. A Drupal theming session where John Britton informed us about the Knight Drupal Initiative, and we organized what will hopefully become regular offline meetings for HK Drupalers. Finally, there’s the Start-up Lightning talks where I presented my “Environmentally Conscious Restaurant / Food directory” idea. Hopefully, I can connect with a few kindred souls in the 200+ attendants to help spread the site. (Probably gonna use this “currystar” domain.) Finally, met a young entrepreneur, Alvin, who’s still in studying at Stanford… he was working hard networking and spoke with me about having connections to VC in the US. It’s good to know someone who’s so young and passionate! Saw a couple of Yahoo HK developers, I asked one of them how he felt about Yahoo in HK, and he said it’s too “revenue oriented”. I think this is a typical problem with companies that have grown big and also for small HK companies. As a general observation, I think companies (and people) who are “revenue oriented” are often too short-sighted. Because of that, nothing truly revolutionary will come out of them. At the other end of the spectrum, we have visionaries who dream of producing something that will change the way everybody do things, they might create that revolutionary product, everybody loves them, but then they don’t know how to make money out of it. (The classic Slashdot joke: “Create genius product -> Everybody loves it -> ??? -> PROFIT!!) LOL. Rarely do we see phenomenon like Google ~ where a revolutionary idea also crosses over well into a revenue generating model. Generally speaking though, I am supportive of the latter crowd. Take Google for example, they have tons of talented developers but very little managers (they found that managers were killing innovations, so they fired a majority of them in 2001!), everyone is encouraged to spent some of their work hours to work on their own projects! I think most of their products are not making them any money ~ Gmail, Apps, Docs, Reader… etc, but with so many people converging on their platform, something good must come out of it. (Sort of reminds me of how Yahoo was before the bust.) Now, as an ex-Yahoo, (and more importantly, a shareholder!) I really hope Yahoo can produce something “good for the people” rather than “something that helps the bottom line.” I think in the long run, this will help Yahoo gets back on track. For example, Yahoo Hong Kong is the most visited website in Hong Kong, there are so much more they can do to help the locals, so why aren’t they standing at the forefront of it, but rather they are copying local success like OpenRice.com? At BarCamp, one of the guys is creating a mass transit info site - passionately named it whereismybusrightnowdude.com.hk :P As a returning expat, I am like a foreigner who doesn’t know how to get around HK except for the MTR! Other major cities like Tokyo and London already have something like that, people CANNOT live without these services! Why haven’t Yahoo! HK done something similar?

Read More