DANGER ZONE: Internet Explorer

[http-equiv@excite.com]

Friday, December 26, 2003

Technical 'silent delivery and installation of an executable on a
target computer. No client input other than viewing and web site'.
This may be achieved with the Internet Explorer series of so-
called "browsers", all security settings set to HIGH !

[***premium advertising space: your ad here for a nominal monthly
fee contact sales@malware.com***]

Not so simple:

The current trend is to dismiss, pooh pooh, the never-ending ongoing
[almost daily] discoveries of vulnerabilities in the Internet
Explorer series of browsers. So much so there remains in the account
a balance of several full and complete remote compromises [courtesy
of: Liu Die Yu
http://www.safecenter.net/UMBRELLAWEBV4/DirSvc/security/originality/m
icrosoft_ie/index.html] summarily dismissed as "well the internet is
a big bad place, don't surf to unknown sites, and sites you do know
and trust, place in the Trusted Zone. You'll be fine. 'Trust Us !"".

Oh. Okay:

The so-called "Trusted Site" zone setting in the Internet Explorer
series of browsers, is set to LOW on default [screenshot:
http://www.malware.com/trustus.png 28KB]. What that means
is 'minimal safeguards and prompts are provided...most content is
downloaded and run without prompts'. So who do [can] we trust?

For example, we input into the so-called Trusted Zone, the
manufacturer commonly known as Microsoft Dot Com [screenshot:
http://www.malware.com/havefaith.png 15KB]. In fact this peculiar
method and remedy of participating in the World Wide Web is
recommended by the brains behind the the manufacturer commonly known
as Microsoft Dot Com.

Now what:

There is a small yet critical bug in the mailing list software
called LISTSERV from http://www.lsoft.com/. A trivial yet important
ability to effect the common so-called 'cross site scripting' [see:
http://www.cert.org/advisories/CA-2000-02.html] 'malicious html tag
embedding in client web requests':

Microsoft.com uses the mailing list software called LISTSERV. So do
some 300,000 combined public and local others [Note: These numbers
do not include Intranet servers]. Banks. Governments. Schools etc
[see: http://www.lsoft.com/customer/clientlist.asp].

So:

So what that means is if we 'trust' our government, or trust our
bank or our school or even our software 'manufacturer', we are
advised to place everyone else in the 'restricted zone' and our
trusted sites in the 'trusted zone' where: 'minimal safeguards and
prompts are provided...most content is downloaded and run without
prompts'.

Example:

http://discuss.microsoft.com/SCRIPTS/WA-MSD.EXE?A0=<IMG%
20SRC=javascript:document['write'](location)>&T=malware is in the
zone<object>

http://lists.state.gov/SCRIPTS/WA-USIAINFO.EXE?
A1=<img>ind0312d&L=dosback

http://demo.lsoft.com/Scripts/wa-demo.exe?A1=ind9807&L=demo<img>

What that means is we can install via
<object classid="" codebase=""> any executable file from within the
same domain as we see fit. The same domain in the so-called 'Trusted
Site' zone that is. Be it *.gov. *.microsoft.com, *.edu et cetera.

Technically our codebase cannot point to a remote site outside the
zone as it will be cached in the Temporary Internet File [TIF] and
will prompt for install as that remote site is in the Internet Zone.
However, theoretically we can play havoc within our *.gov and .edu
domains on one another. More importantly, we might very well be
able to write our entire Self-Executing HTML file into all of these
domains:

MIME-Version: 1.0
Content-Location:fi le:///m alware.exe
Content-Transfer-Encoding: base64

TVpEAQUAAgAgACEA//91AAACAACZAAAAPgAAAAEA+
zBqcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5AAA
AngAAAAAAAAAAAAAAAAA=/www.malware.com/ /
<o bjec t CLAS SID="CLSID:5 5 5 5 5 5 5 5 - 5 5 5 5"
code base="mhtml:'+path+'">

In which case the entire package will cached in the TIF under the
disguise of a so-called 'TRUSTED ZONE' !

Don't trust us. Trust them.

[***less than premium advertising space: your ad here for a nominal
monthly fee contact sales@malware.com***]

Happy New Year and be safe out there. It's not what it all seems.


End Call


--
http://www.malware.com

What this all boils down to is that when you add a site to the Trusted
Zone you are giving it additional privileges - this is by design and not
a vulnerability. You can read more about IE Security Settings at

http://www.microsoft.com/windows/ie/using/howto/security/settings.asp

from which we can also read about the Trusted Zone that you should:

"Add a site to this zone only if you trust that it would never cause
harm to your computer."

Giving any site additional executional privileges means that you are
extending your level of trust. You are trusting that the site in
question does not get compromised and have its content replaced with
malicious code, and you are trusting that the site does not have any XSS
errors that would allow harmful code injection into the HTML stream.

There are no sites in the Trusted Zone on a default installation so the
impact is significantly lowered. However, Windows Update is hardcoded to
have additional privileges so if you want to try and practically abuse
the level of trust you would have better luck in trying to find XSS
errors on the Windows Update site or find ways to beat the URL parsing
algorithm that detects whether IE is on the Windows Update site or not.


Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
949-231-8496

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>=20


-----Original Message-----
From: http-equiv@excite.com [mailto:1@malware.com]=20
Sent: Friday, December 26, 2003 9:02 AM
To: bugtraq@securityfocus.com
Cc: NTBugtraq@listserv.ntbugtraq.com
Subject: DANGER ZONE: Internet Explorer

<snip
http://www.securityfocus.com/archive/1/348363/2003-12-26/2004-01-01/0>

<snip http://tinyurl.com/3eldd>

[http-equiv@excite.com]

> You can read more about IE Security Settings at
>
>
http://www.microsoft.com/windows/ie/using/howto/security/settings.asp
>
> from which we can also read about the Trusted Zone that you should:
>
> "Add a site to this zone only if you trust that it would never
cause
> harm to your computer."
>
> Giving any site additional executional privileges means that you
are
> extending your level of trust. You are trusting that the site in
> question does not get compromised and have its content replaced
with
> malicious code, and you are trusting that the site does not have
any XSS
> errors that would allow harmful code injection into the HTML
stream.

It doesn't actually say that. From the link you provided it says is:

"For example, you might put well-known entertainment or shopping
sites in the Trusted sites zone with its low levels of security."

You're saying what we are saying and illustrating, not what they are
saying.

That's the whole point.

See what I am saying.



--
http://www.malware.com