Re: All patches, but still exploited
From: Greg (nospam_at_nospam.com)
Date: 04/12/04
- Next message: Jeff Cochran: "Re: All patches, but still exploited"
- Previous message: Greg: "Re: All patches, but still exploited"
- In reply to: David Wang [Msft]: "Re: All patches, but still exploited"
- Next in thread: Jeff Cochran: "Re: All patches, but still exploited"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 12 Apr 2004 08:29:06 -0700
"David Wang [Msft]" <someone@online.microsoft.com> wrote in message
news:OqbNViHIEHA.828@TK2MSFTNGP12.phx.gbl...
> If I understand you correctly:
> You are saying that if you surfed the websites using default settings on
XP
> that it would not be exploited, but surfing the same website using default
> settings on Windows Server 2003 with IE Hardening turned off would be
> exploited?
>
> Please do verify that all your IE settings between the two systems are the
> same... since it's the same IE6 browser bits in both.
>
> Finally, running IE on a server is discouraged for the exact reason that
> you've experienced. Personally, I run a server as an unprivileged User
with
> IE Hardening enabled, and I use RUNAS in a window as administrator to do
all
> my admin-related work.
>
> As for IE Hardening -- it isn't that hard to use it to browse frequent
sites
> (on XP Pro, I run IE even more locked down than WS03's IE Hardening, and
> after initial ramp-up, it's not hard at all). It's for browsing those
> random, only-once websites that the popup can get laborious, but honestly,
> that is by-design for IE Hardening and suggests that your browsing pattern
> is insecure.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
I agree that it's not hard for frequently visited sites, which I have plenty
of those. I also do a lot of searching just about every day and that brings
me to a lot of one-time sites. This suggests that my browsing pattern is
insecure? Care to explain? If memory serves, the number 2 online activity
is search. You can't always tell from a search result if a page is likely
to try to exploit IE. I must live in an alternate universe since I expect a
web browser to be used to browse the web, not just sites that I'm positive
are not going to try to exploit FLAWS in the browser and OS. There wouldn't
be a browser hijack problem if IE wasn't vulnerable. It seems that everyone
here likes to avoid that. The blame lies with Microsoft's vulnerable
software.
I verified that all IE security settings are set as default on both OS's.
I'm aware that browsing the web with a server is discouraged, but
unfortunately this is my home system and I need to use Windows 2003. I'd
rather not use it in VMWare (or similar product) since most of what I use
the computer for uses the features in Windows 2003. I could always use my
license of Windows 2000 that I have installed in VMWare, but guess what, I
tested it on that URL and it got the hijack too. So I wouldn't have been
protected either way. Both OS's have every single update.
I've known about the popup blocker being included in Windows XP SP2 that's
coming out in June. I don't have my license of XP installed any more since
I had to switch to Windows 2003. I was using a recent install of the Google
toolbar and the popups made it through. Maybe they'll make it passed
Microsoft's popup blocker.
- Next message: Jeff Cochran: "Re: All patches, but still exploited"
- Previous message: Greg: "Re: All patches, but still exploited"
- In reply to: David Wang [Msft]: "Re: All patches, but still exploited"
- Next in thread: Jeff Cochran: "Re: All patches, but still exploited"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
