lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 24 Aug 2004 13:24:00 +0200
From: "mikx" <mikx@...x.de>
To: <bugtraq@...urityfocus.com>
Subject: What A Drag! -revisited-


Most people i talked to consider the Internet Explorer drag and drop 
vulnerability found by http-equiv not as a serious problem, because it 
requires some user interaction and the press pushes this topic way to much 
as the "first security problem in SP2". In an article on BetaNews even 
Microsoft claims it's not a high risk for customers 
(http://www.betanews.com/article/1093035994).

To proof it's not a "hype" created by the media or companies like secunia, i 
created another proof-of-concept based on http-equiv's code that hides both 
the image to drag and the local folder you drop it to. As a result using the 
window scrollbar will install malware in your startup folder.

A little 5x5 pixel "drop zone" will automaticly follow your mouse. Just drag 
the window scrollbar as usual (and a hidden image at the same moment) and 
whereever you release the mouse button you will drop an exe file to your 
shell:startup (as long as you remain inside the browser window of course).

Demo website: http://www.mikx.de/scrollbar/

Dragging the window scrollbar is a common behavior - even if i can't believe 
there was a world before mouse wheels. A common user will probably don't 
recognize the installation at all.

Speaking of behaviors: If service pack 2 is installed you can work around 
this vulnerability by disabling "binary behaviors" in the new IE activex 
settings. You don't need to disable scripting completely.

It took me only 20 minutes to create this, so script kids around the world 
with enough free time will create even better protected mechanisms to 
exploit this bug in the near future.

Take it serious!

mikx 



Powered by blists - more mailing lists