BBC Site Used as IE Attack Lure 83

So... they used BBC news as bait... WOW! It's not like they took over the BBC site and used it.

"The hits keep coming in..." Yeah, 1 every hour. The media wants to make this the most critical vulnerability that ever existed. What a joke.

I mean, a known bug is exploited and it's using quoted text from the BBC site.
If they do it again tomorrow with text from nytimes.com would that be another story?

From TFA:

Click here to read more about drive-by attacks on the Internet Explorer vulnerability.

And if I click there, just what do I get?

(Times like this I'm glad that I use linux ... Until, of course, the next zero-day firefox hole, at which point I'll switch to konqueror or..).

An IE vulnerability! That's news!

According to This article [127.0.0.1], using bogus URL's to trick people is still the most effective social engineering trick in the book. Of course, that may not apply to those in the Slashdot community :p

Not really sure why this is even news. After a computer security competition last weekend, I had the chance to talk to professional security auditors, i.e. hackers. The reason I bring it up is that at one point, one of them said that "he had a web page he would like everyone to visit...with firefox." Needless to say, this scared the shit out of me. After pressing for more info of browser related exploits, he said that IE7 is suprisingly solid security-wise. Same goes for Vista, at least the parts of it that are finished (no more ldap). I shudder at the thought of IE pushers trying to convince people to switch away from firefox because it's not secure enough. I don't know, food for thought.

So, what harm is there in bundling the browser with the OS shipped on 90% of the retail PCs in the world? What harm is there in integrating the browser into the core of the operating system?

Apparently, if you bundle a half-ass product where only lip service was paid to security, the cost is greater than anyone realizes. IE was crammed in there with the sole purpose of crushing Netscape and dominating the Internet market. It was rushed, with slipshod quality and security only as an afterthough -- and that only by the PR department.

"Where do you want to go today?" seems to have found an answer... ...let's stop by your bank and credit card accounts on the way to an organized crime hangout and/or third-world country! Fun!

  -Charles

So Microsoft is planning to release a patch for this zero-day drive-by attack on April 11.....

Hackers Thank God for Microsoft Marketing Policy.

The policy may be designed to make life easier on sysadmins (or, at least, their managers), but it also makes life easier on hackers. I mean, if I had a zero day exploit, I'd start using it on patch day. That way I'd probably have a full month to exploit it before Microsoft released their scheduled patch.

Scheduled monthly patches are fine for non-critical issues, but when you have zero-day drive-by exploits like this, you've got to have a policy that puts user security ahead of marketing hype. Waiting until you have a full-fledged epidemic is not the way to secure your user's future.