Safari Flaw Worse Than First Thought

Microsoft is warning that a previously disclosed flaw in Apple's Safari browser could have dire consequences for Windows users.


Safari Flaw Worse Than First Thought, Microsoft Warns

The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a victim's desktop with executable files, an attack known as "carpet bombing."

It turns out that if this flaw is exploited in combination with a second unpatched bug in Internet Explorer, attackers can run unauthorized software on a victim's computer, according to Aviv Raff, a security researcher. Raff says he originally reported the IE flaw to Microsoft more than a year ago, and then told them about how it could be combined with the carpet bombing bug just over a week ago.

IDG News Service tested Raff's demonstration attack code, which runs Windows Calculator on a victim's system. For the attack to work, a victim must first visit a maliciously crafted Web page with the Safari browser, which in turn will trigger the carpet bombing attack and exploit the IE flaw.

Both the Safari and IE bugs "are moderate vulnerabilities that, combined, produce a critical flaw, which allows remote code execution," Raff said in an instant message interview.

Microsoft is taking the issue seriously. It released a security advisory on the problem late Friday, a sign that it may be working on a patch for the IE flaw. The advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple."

The attack reportedly affects all versions of Windows XP and Vista, Microsoft said.

Apple may not be rushing out to patch this bug, however. Dhanjani says that Apple has told him that it is not treating the Safari bug as a security issue, a response that has generated criticism from the security community. Last week, for example, the consumer advocacy group Stopbadaware.org urged Apple to reconsider this stance.

According to Raff, unless Apple patches the bug, more attacks like the one he found in IE are likely to pop up. "This is not the only issue that can be combined with the Safari vulnerability," he said. "If Microsoft fixes this, Safari users will still be vulnerable."

The Modern Browser Wars

Apple's Safari, Mozilla's Firefox 3, and Microsoft's Internet Explorer 8 duke it out to be the program you use most on your PC.


Updated Web Browsers: Which One Works Best?

Back when the earliest programs for viewing Web content simply browsed flat pages of images and text, the name browser truly fit the software.

But yesterday's amateur pages have evolved into dynamic, content-rich portals and powerful online programs. For many online habitués, the do-it-all browser has become a PC's single most important program.

Recognizing that fact, Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox are battling to win the nod as your browser of choice. So which one should you use--Safari 3.1, Firefox 3, or Internet Explorer 8?

Apple's latest offering, Safari 3.1, preserves the company's signature focus on clean design and smooth usability, but it lacks any phishing or malware filters.

For its part, Mozilla should have applied the finishing touches to Firefox 3 by the time you read this. From under-the-hood memory improvements to a major reworking for bookmarks, version 3 represents a big step forward.

Whereas the new Firefox and Safari browsers are ready to roll, Microsoft's early beta of Internet Explorer 8 remains a work in progress. Bugs and rough edges are to be expected in a first beta intended for developers and testers. But IE 8 beta 1 provides a glimpse of new features such as WebSlices (which let sites create widgety snippets of information that you can view by clicking a bookmark button) and Activities (which add right-click menu options for looking up selected text and pages on map, translation and other sites) that will distinguish the browser Microsoft eventually releases.

Firefox, IE, and Safari are the three most popular browsers, according to Internet usage statistics, but they aren't the only ones available.

(SIDEBAR: This is my 100th post in this blog! Kudos to me :))

Heads up on IE8 Beta 1

Microsoft today unveiled Internet Explorer 8 (IE8) and welcomed users, as well as developers, to download and install the preview.

Microsoft Unveils IE8 Beta 1

Gregg Keizer, Computerworld

Microsoft Corp. today unveiled Internet Explorer 8, and posted links to what the company called "Beta 1 for developers." Anyone, however, can download and install the preview. (As did PC World's Melissa Perenson and Editor in Chief Harry McCracken.)

"I am pleased to announce that Beta 1 for developers is available now," said Dean Hachamovitch, the IE group's general manager, in a presentation from MIX08, a Microsoft Web development conference that opened today in Las Vegas, Nev.

According to the download page published early today, IE8 Beta 1 will be available in separate versions for Windows XP, Windows Vista, Windows Server 2003 and Windows Server 2008.

Although Hachamovitch pegged Beta 1 as fit for developers, there's nothing to stop the general public from downloading and installing the browser. "This beta release is available to everyone," Microsoft's download notes read, "but is primarily for Web developers and designers to test the new tools, layout engine, and programming enhancements."

Among the new features Microsoft touted in other sections of the sub-site dubbed "Internet Explorer 8 Readiness Toolkit," were tools called "WebSlices" and "Activities." The former somewhat resembles the "Web Clip" feature introduced in Apple Inc.'s Safari Mac OS X 10.5 "Leopard;" the latter appears to be a small-scale mash-up tool. Both will be developer-, not user-created.

WebSlices (IE8) and Web Clip (Safari) let users designate content within a page -- dynamically-updated stock prices, for example, -- and then monitor changes to that content. But while Safari's Web Clip lets users create desktop widgets for easier access, IE8's WebSlices only allows users to add them to the Favorites bar or to a new row below the browser's address bar. In other words, IE8 users must still click to see the content after they're notified that changes have occurred.

Activities, meanwhile, are pre-designed mash-ups that Microsoft and third-party sites and services will offer free of charge. A dedicated Activities page currently lists a dozen samples, ranging from one that helps users find and preview items on the eBay auction site to another that maps addresses on Windows Live Maps.

"Activities are how developers can integrate the content of their sites with the Web," said Hachamovitch.

Other enhancements and additions to IE8 include a revamped Favorites bar, automatic crash recovery and an improved anti-phishing filter. By comparison, Mozilla Corp.'s Firefox and Apple's Safari both currently offer crash of one sort or another, while Firefox also sports anti-phishing protection.

Earlier this week, Microsoft's IE development team announced that IE8 would support a new "super standards" mode by default , rather than optionally, to stress Web standards over backward compatibility.

"The Web gets better when developers spend less time on interoperability [problems] and more time on innovating," said Hachamovitch. "Long term, this is the right thing to do for the Web."

Although Hachamovitch pegged Beta 1 as fit for developers -- "Please try it out," he urged the MIX08 audience at the end of his presentation -- anyone can grab it. The client-side 32-bit downloads weigh in at 14.4MB for the Windows XP version, and 11MB for the Windows Vista edition.

"We're only part way done with IE8," said Hachamovitch. "But you can see where we're focused."

source: computerworld.com

IE Still has Problems

After users reported problems with the recent patch of Internet Explorer, Microsoft offered a way to work around the unexpected bug.

Microsoft Offers Work-Around IE's Problem

Microsoft released a critical security patch for Internet Explorer last Tuesday, fixing some bugs in the browser. However, soon after users installed it, they began reporting that Internet Explorer would crash when visiting certain websites. Windows would then report that 'Internet Explorer has encountered a problem and needs to close'

Microsoft has offered a technical work-around for Internet Explorer users who have found their browsers crashing after installing a recent set of security patches. Microsoft now says that the problem is not widespread and affects certain custom installations of Internet Explorer 6 on Windows XP, Service Pack 2.

Users who have experienced this problem can fix it by making some tweaks in the Windows Registry, described in this Knowledge Base article.

Microsoft did not say what kind of customization would cause the bug, and company representatives were not immediately available for comment.

Some newsgroup users are speculating, however, that the issue may be related to antivirus software. Symantec and McAfee users who have been experiencing the problem have been able to resolve the issue by uninstalling the security update and then uninstalling their antivirus software, installing the update and then reinstalling their AV products, said Frank Saunders, a Windows user who has been following discussion of the issue.

The Internet Explorer patch associated with this problem -- MS07-069 -- is considered to be the most important of last week's updates because it fixes four critical vulnerabilities in the browser.

Microsoft Internet Explorer 8

Microsoft is developing Internet Explorer 8, and expects the first beta version to be released in the first half of 2008


Internet Explorer 8 in 2008
Microsoft is planning the release of the first beta of the next version of Internet Explorer in the first half of 2008. The corporation also said the Internet Explorer 8 has passed a key web standards test that ensures the browser won't "break" the web.

IE 8 has passed the "Acid2 Browser Test" from the Web Standards project. The test shows whether the browser renders a website in a certain way. If the browser displays the site correctly, it means the browser support certain accepted web standards.

Microsoft developed Internet Explorer before some web standards, such as CSS and RSS were developed, so older versions doesn't support some of the current standards. Since Internet Explorer was the de facto of web browsers, developers would often write web sites and codes to work with Internet Explorer, rather than to support the web standards. Microsoft also was lax in updating IE to meet the demands of web standards, since there was little competition in the browser market for years.

When Mozilla Firefox was released three years ago, the browser's need to stay current with web standards was once again moved to the forefront. Microsoft released Internet Explorer 7 in October 2006, and the company had good intentions - they decided to improve support for web standards with the new release.

However, some websites that were created for the older versions of IE didn't work properly on IE7. Microsoft hopes to remedy this problem so the situation is not repeated with IE8, according to an IE Blog posting attributed to Dean Hachamovitch, a Microsoft general manager on the IE team.

"With respect to standards and interoperability, our goal in developing Internet Explorer 8 is to support the right set of standards with excellent implementations and do so without breaking the existing Web," according to the blog posting.
Hachamovitch said Microsoft is taking a cue in lessons learned from making improvements to CSS in IE7 that "made IE more compliant with some standards and less compatible with some sites on the Web as they were coded." The key design goal for IE8, he said, is compatibility with existing Web sites and Web standards supported in other browsers to provide a premium user experience.

"As a developer, I'd prefer to not have to write the same site multiple times for different browsers," according to Hachamovitch's post. "Standards are a (critical!) means to this end, and we focus on the standards that will help actual, real-world interoperability the most. As a consumer and a developer, I expect stuff to just work, and I also expect backwards compatibility. When I get a new version of my current browser, I expect all the sites that worked before will still work."

Microsoft said the final release of IE8 depends upon feedback received from the beta process.

IE Crippled By Update

Microsoft is investigating a security update released last week that has crippled Internet Explorer and prevented users from surfing the Web.

Microsoft Update Cripples IE
Microsoft has confirmed that it is investigating reports regarding a security update for Internet Explorer issued last week, crippling some users' ability to get on the web with the said browser.

Users started posting messages on forums and Microsoft support newsgroup after Microsoft released the MS07-069 Security Bulletin on December 11. Most of them are saying that they could not use Internet Explorer to connect to the internet, either because Internet Explorer refused to launch, or because when it did open, it could not open various websites.

"About 60% of the time, I would get an 'Internet Explorer has encountered a problem and must close' dialog," reported Bill Drake on the Windows Update newsgroup. Others echoed those comments on IE-specific forums, noting that both IE6 and IE7 balked at loading, or while loading, some pages, particularly home pages, on both Windows XP and Windows Vista machines.

Harold Decker, operations manager at San Diego-based Gold Peak IndustriesNA Inc., started fielding calls from users last Wednesday morning as soon as people hit the office. "I stopped everyone who hadn't installed the update from installing it, after four PCs out of 14 had the problem," said Decker, who manages a total of 35 Windows XP SP2 machines. "We're a pretty plain shop; all our systems run Windows XP SP2 and IE6," said Decker. "But some kept crashing. It seemed limited to the window that was opened, and changing the home page to something simple, like a blank page, gave a better success rate."

Microsoft said it is currently creating a patch. "Our customer service and support teams are investigating public claims of a deployment issue with Microsoft Security Bulletin MS07-069," Microsoft's Mark Miller, director of security response. "If necessary, Microsoft will update the Knowledge Base article associated with MS07-069 with detailed guidance on how to prevent or address these deployment issues," Miller added.

Other users on the support forums weren't much help, except to suggest uninstalling last Tuesday's security update. That's what Decker did. "We uninstalled [MS07-069] and have had no problems since then," he said.

Microsoft to Release 7 Patches

The last batch of updates this year focuses on security fixes for Windows and Internet Explorer.


A Round of Patches from Microsoft
Microsoft corporation promised to end the year with a bang by scheduling
seven security updates Tuesday to fix flaws in Windows and Internet Explorer.

Even though Microsoft pledged that Windows Vista, the year-old operating system, is the most secure version of Windows ever, it will still be affected by five of the seven updates. "That's no small percentage," noted Andrew Storms, director of security operations at nCircle Inc. "The perpetuates the fact that even though Microsoft said it was secure, it still needs plenty of patches."

Three of the seven updates will be rated "critical" - Microsoft's highest ranking, while the remaining four will be labeled "important", the next lower rating. Microsoft has revealed limited amount of information about the updates in a prepatch notification posted to its website last Sunday.

One of the seven is a sure bet, Storms said, referring to an update for Windows dubbed as important that will affect Windows XP, and Windows Server 2003. "The Macrovision patch is the most likely candidate for what they're calling bulletin 5," said Storms.

Early last month, Microsoft confirmed that attackers were actively exploiting a bug in third-party anti-piracy software bundled with Windows. The software, which Microsoft licenses from Macrovision Inc., had been updated for Vista, which was why that OS was not at risk. Although Macrovision quickly issued a replacement driver for Windows XP and Server 2003, Microsoft said it needed time to prepare and test the update, which meant it missed the November patch deadline.

"The rest of these are a complete surprise to me," admitted Storms. With one exception, he also hesitated at guessing the contents of the remaining half-dozen updates. His one prediction: "Bulletin 7 might be the fix for the WPAD vulnerability."

On Monday, the Microsoft Security Response Center advised users of a bug in the way Windows looks up other computers on the Internet that has resurfaced. The flaw could allow attackers to steer users to an untrustworthy Web Proxy Auto-Discovery (WPAD) server, where they would receive directions to, say, malicious Web sites rather than the legitimate destinations.
"That would be a very quick fix, and unlikely Microsoft behavior, but if the fix is as simple as some have said, it's possible," said Storms.

Unless it yanks one or more from the list at the last minute, Microsoft will end the year having released 69 security bulletins in 2007, nine fewer than 2006's total but 14 more than in 2005.

Microsoft Internet Explorer Flaw

Microsoft acknowledges that there is a vulnerability with Internet Explorer 7 and rushes out fix


Microsoft IE7 to Patch
Microsoft went to work to fix a vulnerability with Windows Internet Explorer and its URI, or Uniform Resource Identifier. The fix is to address the problem in the way Internet Explorer 7 interacts with other programs. But with no fix available at the time, using IE7 on Windows XP machines is risky business.

The vulnerability of IE 7 lies in how it interacts, via the URI handler, with products such as Adobe's Acrobat Reader or Mozilla's Firefox. Before, Microsoft pointed fingers to Firefox. Then, the company, after acknowledging that the problem was its own, went to a slow work on a fix because no known exploit existed at the time. But it went on a frenzy when a Trojan horse attack started infecting machines in October.

The Trojan horse attack, which a user receives as an infected PDF, brings an old social-engineerin ploy, which malware filters usually don't vet. It tricks you into clicking the link by carrying a subject line such as "invoice" or "bill".

Adobe patched Reader, but that only covers one end of the worm home. Microsoft's patch has been in testing for quite a while, and may remain in that state for some time. As of now, try to avoid using Windows Internet Explorer 7 to browse sites that are suspicious. Try other alternatives, such as Firfox version 2.0.0.6 and up, which already has a patch for the URI vulnerability.

Opening e-mail attachements is growing riskier. A Microsoft report found that the first half of 2007 saw a 150 rcent increase in phishing scams and a 500 percent increase in malicous payloads.

Obtain a patch of Adobe Reader fix at the Adobe's site if you don't have the PDF fix yet.

The Fastest Internet Browser

Apple Safari is faster than Internet Explorer and Mozilla, a testing firm says.


Surfing with Apple Safari

A testing firm says that Apple is faster than Microsoft's Internet Explorer, and Firefox - proof to what Apple said in June when it released the new beta version.

The testing firm has tried to download a webpage off a busy server using Apple's Safari, Microsoft Internet Explorer, and Firefox, and timed the results. Based on the tests, Apple's Safari is faster than Microsoft Internet Explorer 7 by 1.6 seconds, and Firefox by 1.2 seconds -- way slower than what Apple is currently advertising: 2x faster than Internet Explorer












However, the test is not conclusive. The firm has tested the browsers by downloading on a busy server - a huge no-no when testing for speed. This will result in bad data as busy servers may respond quicker or slower depending on the load. What they should have used is a local, dedicated testing server, to avoid interference with the data.

Apple has released a public version of Safari 3 on their website, available for both Mac and Windows.

I have tested the new Safari, and I must say it is faster than Internet Explorer 6 and 7. Loading Safari is comparable to Internet Explorer, but loading the page is faster - probably because it uses the progressive technique of loading pictures rather than displaying the image once the download is complete, a technique used by Internet Explorer. Using progressive loading, a blurry avatar or the image is displayed first, and later refined as the whole image is downloaded completely.

Other cool stuff is the tabbed browsing of Safari, and the ability to customize the toolbar (with cool movement animations). Safari for Windows uses manifests from Apple, meaning, the checkbox, option button, buttons, and checkboxes look like the ones on a Mac. Also, the ability to resize a text box is pretty neat. That way, if you want to see your entire text inside one, just drag and resize.

But the biggest drawback is that it does not display all pages correctly, especially the ones with Flash content. Adobe has not yet released a Flash player for Safari for Windows at the time of this writing. Since this version is also a beta, crashes are often.

You can find the latest version here and download the beta here.

Story:
Copyright 2007 by Sonicsoft Corporation
All Rights Reserved
Image: Apple Website

The New Internet Explorer 7

Microsoft released its newest web browser last year, but it was only available for only a limited users as it requires your Windows to pass the Windows Genuine Advantage (WGA)


Microsoft Aims for Safe Computing

Microsoft released the newest Internet Explorer 7 last 2006, and it's the safest Internet Explorer to date, Microsoft said. It sports a cleaner interface, tabbed browsing, always available search box, built-in phishing security feature, pop up blocker, and dozens of new security features. Deleting history, cookies, and temporary files is also made easier with a single click of a button. And finally, Internet Explorer 7 supports transparency for PNG files - a feature supported by other browsers long before.

Internet Explorer 7 was a nice addition to the IE family, but was only available to users running genuine Windows. Before you can download the installer, your computer has to pass the WGA. Not only that, to protect it from being installed to computers running a non-genuine copy of Windows, the installer itself validates your computer before installation.

However, this October, Microsoft removed the validation requirement for Internet Explorer 7. This makes the new web browser available for all users running Windows XP SP2, even if they are running copies of Windows that do not pass the WGA. This will make IE available to a broader public.

While this may look like another attempt to monopolize the web browser business, Microsoft said this move was to increase the security of Windows and the computing world, as this was one of the aims of the company. With the new security features of Internet Explorer 7, surfing the web is safer than before.

You can download the latest version off the Microsoft site.

Story:
Copyright 2007 by Sonicsoft Corporation 2007
All Rights Reserved.