Microsoft investigates spoofing bug

[Nomad559]

http://www.silicon.com/software/security/0,39024655,39117294,00.htm

Microsoft on Tuesday said it is looking into reports of a potential bug in its web browser that could help malicious hackers design convincing website spoofs.

The bug, according to security alerts by a bug hunter and a Danish security company, Secunia, could let hackers use a technique to display a false web address on a fake site.

[JailBush]

1. Shouldn't Microshaft EMBRACE a spoofing bug?

Maybe they can design something that will convince consumers that Microsoft software products are class acts!

[parasim]

2. Wow. If this is true...

... that is a huge problem. If malicous hackers can create a dupe of a website that appears entirely legitimate, it would throw the authenticity of each and every page of every site on the web into question, wouldn't it?

I'm sure glad I use Safari on the Mac...

[Kellanved]

3. it is true

One can see the bug at work here (German - click "test"):
http://www.heise.de/security/dienste/browsercheck/demos/ie/e5_18.shtml


Safari (i.e. Mozilla) is pretty secure - very few exploits known for that one.

[parasim]

4. thanks

for the link to the demonstration. It still is putting a rather suspicious "http://..." in the address bar, but it still could fool a lot of people...

As for Safari, yeah, I do feel somewhat safer, but who's to say perhaps nasty exploits for Mozilla are just not known yet...

For the life of me, I cannot understand the motives of malicous hackers. Are they simply Luddites trying to foil technological progress, script-kiddies getting drunk on power, insidious agents using fear to force government regulation of the internet to disrupt the free flow of information and completely control consumers' behavior... or...?

[Kellanved]

6. it's worse than that

IE doesn't display the @part if the spoofing bug is used. The URL line reads "http://www.microsoft.com" with no sign of the spoof. One can even click the adress bar and hit enter - the site reloaded stays the same.

Most bugs in IE are due to the Mircosoft protocols (ActiveX) or JavaScript. The JavaScript and Java bugs can be a problem with Mozilla as well.

[TreasonousBastard]

7. Opera gave me a security alert popup...

that told me what the real url is. Nice touch, but it doesn't always work if I click a link from Eudora or Agent.

So, the eBay scam has been going on for almost a year now, if not longer, and now M$ is going to "investigate?"

[Robb]

5. Not a bug!

It's a feature...!

Geez. Like you've never even heard of Microsoft. ;)