Re: Why you should use a firewall on Win98

From: Gerald Vogt (vogt_at_spamcop.net)
Date: 03/15/05 

Date: Tue, 15 Mar 2005 13:41:54 +0900

Connected wrote:
> Unless you use Lynx or FF with no Java or Java scripting you are not
> safe.
>
> http://www.theregister.co.uk/2005/03/11/alternative_slimeware/

Read the article it is pointing to at

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

Quote:
> ...well, not exactly. Visit the same page in FF and, with the JRE up
> and running, the below happens (click here for a bigger view of the
> webpage):
[picture here]
> Being a curious soul, I agreed to the install - and quickly wished I
> hadn't!

For this to happen, it takes

1.) to browse to a website that uses this applet.
2.) to accept a signed applet for which: (from the picture)

"Do you want to trust the signed applet distributed by "Integrated
Search Technologies"? Publisher authenticity can not be verified. The
security certificate was issued by a company that is not trusted. The
security certificate has expired or is not yet valid."

That is _you_ have to click _yes_ to run the applet. So _you_ must
explicitly give an applet access rights to your computer. Once _you_
have done that it can do whatever it likes.

So I still cannot see why I am not safe with my Firefox with Java and
Java scripting. This is not an exploit where something runs or installs
without the user consent. The latter would worry me, but not something
where the normal security mechanisms jump in.

It is no real difference than taking the next best e-mail attachment and
just blindly executing it. Still it is _you_ who has to run the thing...
You just don't open attachments that you don't know about. You just
don't ActiveX controls that you are not expecting, in particular not on
web sites you just browse through in search of something particular. You
just don't trust arbitrary Java applets on your computer which is
basically the same as accepting an ActiveX control for installation.

Nothing of the above references or even mentions issues with JavaScript.

Gerald

Relevant Pages

  • Technical information about the vulnerabilities fixed by MS-02-52
    ... The patch doesn't fix all of the vulnerabilities we reported, ... Java support in the Internet Zone even after applying the patch gives the ... possibility for a malicious Java Applet to gain control over the system. ... Our original report and information regarding the remaining Java ...
    (NT-Bugtraq)
  • Technical information about the vulnerabilities fixed by MS-02-52
    ... The patch doesn't fix all of the vulnerabilities we reported, ... Java support in the Internet Zone even after applying the patch gives the ... possibility for a malicious Java Applet to gain control over the system. ... Our original report and information regarding the remaining Java ...
    (Bugtraq)
  • [Full-Disclosure] Technical information about the vulnerabilities fixed by MS-02-52
    ... The patch doesn't fix all of the vulnerabilities we reported, ... Java support in the Internet Zone even after applying the patch gives the ... possibility for a malicious Java Applet to gain control over the system. ... Our original report and information regarding the remaining Java ...
    (Full-Disclosure)
  • Re: Java Question
    ... if the anfy applet works for you then I don't know why the game ... I'm a little unclear about part of your instructions to go to my Java ... message that I need to download and install Macromedia Flash Player (which I ...
    (microsoft.public.windowsxp.general)
  • Technical information about unpatched MS Java vulnerabilities
    ... These are some technical details about the security vulnerabilities I've ... There were more than 10 vulnerabilities found in the Microsoft's Java ... cookies related to www.bank.com if the applet tag on www.bank.com ...
    (Bugtraq)