|
|
|
|
Windows Secrets Newsletter • Issue 85 • 2006-10-26 • Circulation: over 140,000
|
|
For links to every subtopic in this issue, scroll down to the
Index |
|
ADS
|
|
TOP STORY IE 7 needs tweaking for safety
IE 7 suffers from some IE 6 weaknesses IE 7 does benefit from some significant updates over IE 6. For example, the so-called Phishing Filter in IE 7 warns you if a page you're about to visit is in a real-time database of hacked sites. (You must turn on this filter for it to work. Hopefully, most users will do so because IE 7 asks for the filter to be enabled the first time you use the new browser.) Also, IE 7's new Protected Mode, which only works in Windows Vista, will prevent Web sites from modifying system files or settings. I described several of these new features in my Executive Tech column on Oct. 24. Unfortunately, IE 7 still contains some security weaknesses that were present in IE 6 — and which Microsoft still hasn't fixed in that older browser. The most publicized example since IE 7 went gold is the so-called MHTML hole. This problem allows a hacked site to read information from the window of a different site you're visiting, such as an online banking service. The respected security firm Secunia published an advisory on Oct. 19 publicizing a free test for the weakness in IE 7. The problem in IE 7 is almost identical to the one described by Secunia in an April 2006 advisory that affects IE 6. (Contributing editor Chris Mosby has more in his column in today's paid newsletter, below, about this and other flaws that IE 7 has inherited from IE 6.) Neither the IE 6 nor the IE 7 problems are considered severe. Secunia rates them only 2 on a scale of 5 in severity, mainly because a hacker must first get you to visit a rogue Web site before being able to read information from other sites you may visit. You can close the holes in both browser versions by changing Active Content to a setting of Disable in the Security tab of IE's Internet Options dialog box. (See Figure 1.)  Figure 1: You can easily disable active scripting using IE 7's Internet Options dialog box. But why stop there? If other weaknesses loom in IE 7 — and you can easily close these holes without waiting for a threat to attack you first — why not protect yourself proactively? Changing IE's profile from weak to strong I contacted Arie Slob (pronounced "slobe"), a Dutch citizen who lives in Malta but works for a U.S. company named Infinisource. Arie runs Web servers for the company and, more importantly, has analyzed the inner workings of most of IE's Internet Options settings. After a telephone discussion with me, Arie completed an analysis of IE 7's Internet Options and posted it on Oct. 25. Back in 2004, I used his findings to recommend changes to 19 of the options in IE 6 SP1. (A link is shown at the end of this article.) Arie told me in a telephone interview that only a couple of IE 6's Internet Options settings had been changed in a more secure direction in IE 7 by Microsoft. He's particularly concerned that, in his words: "There are new settings for XAML and they're all enabled by default." XAML — Extensible Application Markup Language, pronounced "zammel" — is a Microsoft-specific technology designed for corporate developers who wish to deliver simple but striking user interfaces, similar in some ways to Flash animations. There's a risk, however, that XAML might some day be used by hackers to deliver infected code to unsuspecting users. Why would Microsoft enable such technologies by default in IE 7? At Microsoft's Professional Developers' Conferences in recent years, company officials have stated that technologies won't be enabled in Windows by default unless 90% of users would use a technique. (Printing is an example of a technology that should be "on" while macros and other active content should be "off" unless enabled by users or administrators.) Since corporate admins could easily enable XAML companywide using Group Policy, why turn XAML on for all IE 7 users? Why create yet another code monoculture for hackers to take advantage of? The answer is that XAML is built on Microsoft's Windows Presentation Foundation (WPF), a key feature of .NET Framework 3.0. This technology is aimed at corporate developers who Microsoft wants to build Windows-only applications. Rather than ask these large enterprises to flip a simple switch to enable XAML in IE 7, Microsoft apparently decided that compiled .xaml files should run in the browser by default for every Windows user in the world. How to configure IE 7 to protect yourself Just because certain features are enabled in IE 7, that doesn't mean you have to leave them on and expose yourself to rogue examples of such code in the future. Shown below is a concise list of the way Arie recommends that you configure Internet Options in IE 7 to protect your system. In IE 7, click Tools, Internet Options, and then select the Security tab. With the Internet zone selected, the security level by default should be set to Medium-High. Click the Custom Level button. Set the following choices:
Firefox is still a better browser than IE 7 Changing IE 7's default settings can remove some functionality from Web sites you may regularly visit. For example, disabling "active scripting" turns off JavaScript. Many sites use JavaScript to activate various menu options. For example, the menu at the WindowsSecrets.com site (but not in the newsletter) shows you what second-level options are available when you hover your mouse over a top-level option. We've designed the menu at our site so it works (less slickly) even if JavaScript is disabled in a visitor's browser. For example, you can simply click a top-level menu item and the resulting page then shows your second-level choices. But not all sites have this kind of fall-back design. Here are my recommendations on how to use the Web effectively, despite the fact that you've made IE 7 more secure: • Use Firefox, not IE 7. Firefox is inherently a more secure browser that Internet Explorer, even version 7.0. For example, Firefox is not vulnerable to Secunia's test of the MHTML hole that IE 7 (and IE 6 and IE 5) suffers from. Most sites today work with both Firefox and IE (and other major browsers, such as Opera, Netscape, and Mac Safari). Sites that really require IE are declining. If you haven't already installed Firefox, the new version 2.0 can be downloaded from the Mozilla release notes page. (Be sure to read the notes before installing.) • Add legitimate IE-only sites to the Trusted Sites zone. If you encounter a site that you know to be responsible — but it requires Internet Explorer for some reason — you can easily add the site to IE's Trusted Sites zone. In IE 7, pages in the Trusted Sites zone run at the Medium security level (not Medium-High as in the Internet zone) and aren't restricted by the customizations you've applied to the Internet zone. To add a Web address to the Trusted Sites zone in IE, click Tools, Internet Options, and then select the Security tab. Select the Trusted Sites zone, click the Sites button, and add the address of the site you wish to visit. If the site doesn't use encrypted pages, turn off the option Require server verification (https:) for all sites in this zone. It's even easier to add an address to your Trusted Sites if you install Microsoft's Power Tweaks Web Accessories from the company's download page. This applet inserts an option called Add to Trusted Zone right on IE's Tools menu. (Microsoft's download page says the download is only for IE 5, but it works fine on IE 6 and IE 7.) • Easily open pages in IE while in Firefox. If you use Firefox routinely, you can quickly open an IE-only page in IE by clicking an icon on the Firefox toolbar. To do this, install IE View, an extension available from Mozdev.org. You can even set specific sites to automatically open in IE, if you absent-mindedly surf to them in Firefox. • Install IE 7 just to protect yourself against IE 6. If you run Firefox or some other secure browser, you may wonder why you should upgrade to IE 7 at all. The answer is that you might be induced to visit an IE-only site some day, and that site turns out to be infected (deliberately or accidentally). Browsing with IE 7 instead of IE 6 does provide you with better protection, especially if you've made the changes shown above. To install IE 7, visit Microsoft's download page. • Why not just set IE 7's security level to "High"? It's always possible to crank IE's Internet Zone up to the High security level instead of Medium-High. Doing this, however, makes most Web sites unusable, because IE then pops up a warning every time some harmless page script runs. Sometimes, several warnings appear on every page of a site. Using the customized settings shown above — and adding respected companies to your Trusted Sites zone — provides you with fairly good protection without subjecting you to such pointless harassment. • Watch out for ClearType after installing IE 7. Rudely, IE 7 (when installed on XP machines) enables ClearType in browser windows, even if you had previously disabled it. ClearType makes text look less jagged on LCD screens, but it can make type look fuzzy on CRT monitors. This can affect other applications that use the IE rendering engine, such as the preview pane in Outlook and FrontPage. You can turn ClearType off by running IE 7, clicking Tools, Internet Options, and selecting the Advanced tab. Under the Multimedia section, turn off Use ClearType. Alternatively, you can try tuning the effect to see if you like it, using MS's online tuner page. How to test your browsers for safety As mentioned earlier, Secunia provides harmless test pages that can show you whether a particular browser is vulnerable to a known security threat. You should test every browser that you use. Secunia's test for the MHTML hole is linked to from two separate pages that apply to IE 7 and IE 5/IE 6 and Outlook Express 5.5 and 6. Another set of tests demonstrates a new threat first reported on Oct. 25. This flaw, which Secunia rates as only 2 on a severity scale of 5, allows a rogue Web site that you visit to fake the address bar in a pop-up window that appears later. The pop-up window can appear to originate from a legitimate site that you happen to be visiting at that moment. This can lure you into entering passwords or other personal data. This pop-up test is linked to from a page that specifically mentions IE 7. Firefox 1.x, however, also appears to be vulnerable to this kind of spoofing. There's no workaround to correct this in either browser at this time, so always be suspicious of any pop-up window that appears unexpectedly. Important note: If you've made the changes shown above to harden IE 7, the link on Secunia's test pages entitled Test Now — Left Click On This Link won't do anything when you click it. The lack of action demonstrates that the vulnerability has been eliminated. But it can be confusing if you don't know why the link isn't working. Arie Slob provides three separate pages that explain the weaknesses in different versions of Internet Explorer and how the Internet Options should be changed. These pages cover IE 7, IE 6 with Service Pack 2, and IE 6 with Service Pack 1. My original Windows Secrets story, which described how to harden IE 6 with Service Pack 1 (for people who, for whatever reason, couldn't upgrade to SP2) was published on Nov. 18, 2004. How to get more information As I mentioned earlier, Chris Mosby's column in the paid version of this newsletter explains how to protect yourself against new threats that haven't yet been patched. Susan Bradley's column describes how to work around any problems that have been found with officially released patches, and Ryan Russell's column teaches you how to know when you have adequate protection. To get these columns, and gain access to all of our old and new paid content for a full year, you can upgrade to the paid version of the newsletter. We don't require any fixed fee. You can contribute whatever it's worth to you. We want as many people as possible to have this information. How to upgrade That's it for now. If you have further information to share about IE 7, or you have a tip on any other topic, send it to me using the Windows Secrets contact page. You'll receive a gift certificate for a book, CD, or DVD if I print a comment that you send. Thanks! Brian Livingston is the editor of WindowsSecrets.com and the coauthor of Windows Me Secrets and nine other books. |
|
THE SECURITY BASELINE The Security Baseline as it stands By Brian Livingston No new reviews of security products have recently been published by major test labs that change the rankings of the top-rated items. This means that there are no changes this week in what respected reviewers consider the best add-ons to stop malware. Based on the latest published findings, the best four products to give your PC comprehensive protection against hackers are (1) a Linksys hardware firewall, (2) ZoneAlarm Security Suite, (3) Webroot Spy Sweeper for antispyware protection, and (4) Shavlik NetChk Protect for update management. See details below.
|
|
HERE'S A TIP The best stuff is in our paid version To upgrade, simply make a contribution of any amount you choose. If you do this by Nov. 15, 2006, you'll instantly be sent the full, paid version of today's newsletter. Subscribers to the paid version receive additional information in each issue. Some of the extras this week are:
Make a contribution to support our research into Windows and you'll immediately be able to read and search through scores of valuable articles. In addition, paid subscribers are entitled to download valuable content that we license for you at least once every calendar quarter. To upgrade to the paid version of Windows Secrets, please visit our upgrade page. Thanks in advance. |
|
EBOOKSHELF
|
|
USEFUL LINKS Free software (just pay here) An antispyware researcher claims that the Google search engine is running ads for companies that charge consumers money for software that's usually given away for free. (By Brian Livingston, Datamation) More info Is IE 7 really more secure than IE 6? IE 7 resolves many security weaknesses, some of which Microsoft never got around to patching in IE 6. The new version of the browser isn't perfect, however, so you still have problems to be aware of. (By Brian Livingston, Datamation) More info |
|
WACKY WEB WEEK A little cleavage with your search results
|
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published twice a month on alternating Thursdays. Issues appear 2 days and 16 days after Microsoft Patch Tuesday (the 2nd Tuesday of each month). Only the first issue of the month is published in August and December to allow vacation breaks. A short "news update" is sometimes published between regular newsletters. Publisher: WindowsSecrets.com LLC, 300 Queen Anne Ave. N. #456, Seattle, WA 98109 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editor: Brian Livingston. Contributing Editors: Susan Bradley, Woody Leonhard, Chris Mosby, Ryan Russell. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|
