Windows Secrets Newsletter • Issue 178 • 2008-12-17 • Circulation: over 400,000

By Mark Joseph Edwards

Microsoft recently announced that a special, out-of-cycle patch would be released on Dec. 17 for Internet Explorer’s latest security vulnerability, the so-called XML exploit.

If you’d like to avoid similar weaknesses that are certain to be discovered in IE in the future, the simple solution is to use a different browser, such as Firefox, with a few easy customizations that allow you to switch to Microsoft’s browser only for sites that absolutely require IE.

If you haven’t yet patched IE to protect against the XML exploit, visit Microsoft’s December 2008 security advisory. This Web page, which began as an announcement of the Redmond company’s planned patch, changes automatically to information about installing the patch as soon as the fix is released.

WS contributing editor Susan Bradley reported on the dangerous zero-day exploit in her Dec. 11 Patch Watch column (paid content). The security hole affects many different builds of IE 5, 6, and 7 as well as the beta version of IE 8. Every recent version of Microsoft’s operating system is potentially affected: Windows 2000, XP, Vista, Server 2003, and Server 2008.

The Redmond software giant acknowledged on Dec. 16 that more than two million Windows users had already become infected via the IE flaw, according to an article by the Press Association. How many more people will get hit before the patch is widely distributed is anyone’s guess.

Microsoft published a security advisory on Dec. 10, listing nine potential workarounds, before the patch became available. Many people, myself included, felt that the explanation did a poor job of clarifying which combination of fixes a particular user should implement. The company’s Security Vulnerability Research and Defense blog attempted to clarify matters on Dec. 12. But the information there still left most people wondering how to determine the best combination of workarounds for their systems.

IE zero-day flaws cry out for switch to Firefox

There’s no easy way to secure IE against similar flaws that will inevitably be discovered and used by hackers to their advantage in the future. For this reason — and in response to pleas for help by many Windows Secrets readers — here’s my recommendation on the best way to surf the Web more securely:

• Step 1: Switch to Firefox, Opera, Chrome, or another contender and configure it to be your default browser. Use IE only to visit sites that require Microsoft-specific technology — probably because they rely on ActiveX to function. (For example, you need to use IE to download patches at the Windows Update site.) I recommend Firefox because of the numerous add-ons available for that browser, some of which I describe in Steps 2 and 3.
  
  
• Step 2: Install the Firefox add-ons known as User Agent Switcher (see UAS’s download page) and IE Tab (download page).
  
  User Agent Switcher lets you change your browser’s identity. If a Web site demands the use of IE but actually works fine with other browsers, you can change the name of the operating system and browser the site thinks you’re using. Many “IE only” sites render perfectly well in Firefox and other browsers.
  
  IE Tab lets you open a site in a new Firefox tab that’s driven by IE’s rendering engine. This allows sites requiring ActiveX or other IE-only components to work in the same way they do in IE itself.
  
  Unfortunately, using the IE rendering engine in a Firefox tab leaves your PC just as susceptible as it would be if you’d opened an IE window in the first place. Use this technique with caution and only with sites you feel are very unlikely to be hacked, such as Microsoft.com.
  
  
• Step 3: For added security, install the NoScript plug-in, which disables JavaScript, Flash, Silverlight, and other “active content” (see NoScript’s download page). Because most Web sites of any complexity use JavaScript for menus and other functions, place in the utility’s “whitelists” sites such as Microsoft.com and WindowsSecrets.com that are unlikely to try to run malicious scripts on you.
  
  WS associate editor Scott Dunn wrote more about NoScript and other Firefox security add-ons in his Apr. 17, 2008, lead story.
  
  
• Step 4: Open an Internet Explorer window and set the security level of IE’s Internet zone to High. To do this, click Tools, Internet Options, Security. Choose the Internet zone in the box at the top of the dialog and move the slider control below it to High. Note that this setting will cause many sites you haven’t added to IE’s Trusted Sites zone to render incorrectly or display error messages.
  
  
• Step 5: If for some reason you can’t install Microsoft’s Dec. 17 IE patch, refer to Microsoft’s Dec. 10 and Dec. 12 advisories for workarounds, as I mentioned above. The latter page, for example, describes how to adjust Access Control Lists by using Registry scripts in an oledb32.zip file you can download from Microsoft. (The download link is at the end of that page.)
  
  Be aware that some of the workarounds Microsoft recommends can have unexpected side-effects. For example, a comment posted by the Internet Storm Center on Dec. 16 stated that Microsoft’s “Disable XML Island” workaround prevents users from sending e-mail using Exchange 2003 and Outlook Web Access.
  

If you need any more evidence that weaknesses in IE can be rapidly used by hackers, take a look at a wiki page provided by the Shadowserver Foundation, a security group that lists sites known to be infecting unsuspecting visitors. IMPORTANT: Do not visit any of the sites on the list, even if you think your browser is secure — these sites are or were infectious.

The point is that thousands of sites became carriers within days. (The Press Association quotes Trend Micro as saying more than 10,000 sites were compromised by Dec. 16.) If you use a URL filtering system or block list, you should add the sites cited by Shadowserver to prevent access — at least until all your machines are patched or a specific site is proved to be clean.

Mark Joseph Edwards is a senior contributing editor of Windows IT Pro Magazine and regularly writes for its Security Matters blog. He’s a network engineer, freelance writer, and the author of Internet Security with Windows NT.