IE7: bad, Firefox 2.0: good? (and ultimate Coke+Mentos)

Woah there, it's IT Blogwatch, in which another IE7 vulnerability rears its ugly head, prompting the inevitable comparisons with Firefox 2.0. Not to mention more amazing experiments with Diet Coke and Mentos...

Jeremy Kirk has deja vu. All over again:

A security problem originally found in Microsoft Corp.'s Internet Explorer 6 browser has returned to haunt IE7, the new version of the browser launched two weeks ago, a security consultant said Monday. Danish security consultancy Secunia AsP posted an advisory regarding an issue where an attacker could potentially snare logins and passwords from an unsuspecting IE7 user. Over two years ago, security researchers reported the same fault in IE6.

If a user visits a Web site specially crafted by an attacker, and then opens a "trusted" site such as a bank or e-commerce site that has a pop-up window, the attacker can put new content into the pop-up ... This could enable the attacker to ask a user for financial information or passwords.
...
Secunia rated the problem as "moderately critical" ... An alert user might notice that they're under attack ... However, an attacker could also use this problem in combination with a pop-up spoofing weakness identified last week. Microsoft hasn't patched that problem.

Philipe Rubio guesses:

The problem is that it is possible for a malicious website to inject new content into a popup window, which has been opened by a trusted site. This will trick many users and cause the user to believe that the content is served from the trusted site. In IE7 this is mitigated by the address bar always being visible. However, if this is combined with the IE7 "Popup Address Bar Spoofing Weakness" issue from last week, the attack would be very convincing.

This is the third vulnerability to be discovered in Internet Explorer 7 within 2 weeks of its release, and this is probably not the last vulnerability to be discovered. My guess is that we'll see even more vulnerabilities emerging within the next two weeks.

Pasta2000 giggles:

TheSecurity Score: IE7 - 3; FF2 - 0 ... Yup, Internet Explorer 7 has jumped out to a big lead over Firefox 2. Internet Explorer 7 has managed to rack up its third security hole since being released two weeks ago. Firefox 2 has yet to be dinged with a security hole ... To rub a little salt in the wound. With IE7's third security hole being rated as Moderately Critical, that makes IE7 more dangerous to use than the old Firefox 1.5.x. They may have the same number of unpatched security holes, but one of IE7's security holes is rated worse. How much uglier can this get?

But the SpikeSource guys counsel caution:

FireFox launched their latest version 2.0 last week with much fanfare.  Microsoft did the same with their 7.0 release.  There was a bit of a scuffle to see which browser had the first security report lodged against them, and it looks like Microsoft is the first one.  There was an aborted report on FireFox earlier, but it hasn't be acknowledged yet.
However, don't be fooled into thinking FireFox is winning.  Slashdot has an interesting thread titled, 9 reasons not to upgrade to FireFox 2.0 , citing many of the same reasons that has bogged down the previous version of FireFox, namely memory.  Too much effort has gone into new bells'n'whistles and not enough on the real bugbears that cripple this potentially great piece of software.

But MSMVP Sandi Hardmeier stamps on the brakes:

Let's be realistic here ... Imagine, if you will, that you go to a fake Bank Web site - assuming the page isn't blocked by the phishing filter in the first place - then it has to convince you to click on a link that leads to a legitimate Web site... then the owners of the hostile site have to hope that your computer doesn't goes nuts from the hundreds of popups per minute that are being generated. The constant clicking from the blizzard of 2 to 3 pop-ups per second is a dead giveaway that something is wrong to anybody using IE7 with its default settings.
...
So, if the user has not turned off the addressbar for popups, or does not see that the address is wrong, if the user does not close the hostile Web site, if the user has turned off the IE sound cue that a pop-up has been blocked or the system does not have a sound card or speakers, if the user has turned off the info-bar, or the user has disabled the pop-up blocker, then the chances of success go up marginally - but the site still has to get around the phishing filter. And it has to get around the problem of convincing users to trust a site if hundreds of pop-ups within a couple of minutes is not normal behaviour for the site being spoofed.

David Berlind reads between the lines:

My point isn't that either browser has vulnerabilities or that one is less insecure than the other. My point is how the conversation regarding these and other insecurities that you just know certain people are racing to find will very likely overshadow the conversation about why these browsers represent advancements over their predecessors. Instead of upgrading to them for their features, the first question will be, but are they secure? Answer: No software except for "Hello World" is 100 percent secure. Ever. Now, the conversation appears not to be about why I should upgrade to one of these. It's about why I shouldn't.

Bink.nu denizens discuss:

• xMorpheousx416: Caused Secunia to divert USA Today's website on my machines - went directly to an advertisement page,....and caused a popup "block" loop in Firefox 2.0.  The popup bar in FF just kept blocking the repeated attempts for the test site from opening a popup.
• robhardman: I'm not so sure of Secunia's statement, as the "phishing" pop up window clearly displays secunia.com in the address bar, not usatoday.com. It *is* clearly an issue that needs fixing but the attack scope is limited, surely?
• JasonCox: Geez, how many bugs is this company sitting on?

Buffer overflow:

Around the Net

• Steve Kille: X.500 Still Important
• irq13/Bryan Murphy: Security Basic Training: The CIA Triad
• IT Compliance: Website Privacy and Security Lessons >From the USPS
• Freedom to Tinker: Diebold Quietly Recalled Voting Machine Motherboards
• Matt Asay: Analyst: Oracle won't be able to outperform Red Hat on support
• Jack Schofield: MySpace Is So Last Year
• Threadwatch: Yahoo in talks to buy AOL
• Coding Horror: CAPTCHA effectiveness
• Michael Hugos: A Pragmatic Approach to IT Agility

Around Computerworld

• Jerri Ledford: Less gear on the go
• Joyce Carpenter: Why Software SUCKS -- the excerpt and the interview
• Robert L. Mitchell: New York Times imposes selective censorship on readers
• Jeff Boles: Acopia - Tier 0 or hotzone remapping? Taking the cutting edge the wrong way...
• Angela Gunn: Your passport gets out more than you do
• Robert L. Mitchell: Stripping down Longhorn virtualization
• Shark Tank: A penny saved, and all that
• Martin McKeay: Useless security measures
• Jeff Boles: What's your value proposition? Got one?
• Douglas Schweitzer: Expect the best, but prepare for the worst

And finally... More amazing experiments with Diet Coke and Mentos

Richi Jennings is an independent technology and marketing consultant, specializing in email, blogging, Linux, and computer security. A 20 year, cross-functional IT veteran, he is also an analyst at Ferris Research. Contact Richi at blogwatch@richij.com.