[gmb45]

-could turn your Windows XP machine into a web server, Microsoft warns


A design feature - or possibly bug - or possibly both - means that internet Explorer can be turned into a web server which will leave your computer's files open to being read online, according to a hacker who demonstrated it at the Blackhat DC conference.

"The flaw, said to extend across all versions of Internet Explorer, is not subject to a patching fix, according to Jorge Luis Alvarez Medina, the Argentina-based security consultant with Core Security Technologies who elaborated on the attack technique during his demo. Indeed, microsoft advised anyone concerned about the potential for this type of attack to run IE in "protected mode," a workaround that Medina also advised. "

Microsoft has, not unsurprisingly, issued a security advisory about it.
It's broadly encouraging, suggesting that it's only going to be effective against IE (all versions) in XP. Versions of Windows above that seem to be OK.

"Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location. These versions include Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service 4; Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4; and Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on supported editions of Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows Server 2003 Service Pack 2. Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008."

And XP users run IE in protected mode, don't they?

"Other workarounds in IE, according to Medina, would include setting "IE Network Protocol Lockdown," adjusting the security level setting for the Internet and Intranet Zones to "high," and disabling Active Scripting for the Internet and Intranet Zones with a custom setting."

Disabling Active Scripting is otherwise known as "turning off Javascript and ActiveX". This is entirely feasible, though it then renders much of the modern web useless; for example sites like Google Maps, which rely on Ajax technology (which Microsoft invented), won't work without Javascript.
So what's to be done if we want the modern web? Over to Medina:

"But he also noted that since this attack appears to only work against IE, users might want to consider using "a different browser to navigate untrusted Web sites." Medina said it doesn't appear that the IE flaw is subject to patching because it encompasses design features related to how IE and Windows Explorer handle zone elevation, HTML code and MIME types."

Just to expand on that:

"[Medina] said the dialog with Microsoft's security team about the exploit so far has indicated that Microsoft thinks this is not something it can fix because the flaw is so much a part of the fundamental design of the browser. "

In other words, it's not a bug - it's a feature. Certainly for the writers of malware it is. And it's one more reason for people to move on from XP. Let's hope the government is listening.