Victor's Blog about the Web, Security and Life

The web for me is a hobby where standards and best practices are daily bread. Security is a concern that everybody must be aware of its details for IT in general, and the web in particular, to be a safer place. My life, on the other hand, is that of a regular Lebanese citizen where politics and social issues are discussed on a daily basis. I hope you enjoy reading my blog and make sure to drop me a comment about any topic you find interesting.

The Ghost in Internet Explorer 6, 7 and even 8 (Beta)

Printable Version

victor | 24 September, 2008 16:06

I found an interesting article written by Marius Oiaga, related to Internet Explorer security, and addresses the existence of what can be called "Ghosts".

Whether you believe in ghosts or not is irrelevant from a browser point of view. The matter is that you'd better start believing because Microsoft's browsers allow "ghosts" to take more than a peek over your shoulder, in fact, it permits them to see and register every move associated with the browsing process. Secunia has published an advisory titled "Internet Explorer 7 Frame Location Handling Vulnerability" warning of the risks faced by IE users, but not only IE7 is affected. Exploits have also been tested with success on IE6 and even on IE8 Beta 1. And to top it all off, a sample proof of concept is available in the wild at (http://sirdarckcat.blogspot.com/2008/05/ghosts-for-ie8-and-ie75730.html) [You must be using Internet Explorer for this demo to work]. (More)

Security | Permalink | Add comment | Trackbacks (0)

 
Accessible and Valid XHTML 1.0 Strict and CSS