Geek Report » zero day http://geekreport.com Technology Web Blog, News, Reviews, Videos and How to Guides Sun, 17 Apr 2011 14:08:44 +0000 http://wordpress.org/?v= en hourly 1 Microsoft Suggests Avoiding IE For Now http://geekreport.com/509/microsoft-says-avoid-ie http://geekreport.com/509/microsoft-says-avoid-ie#comments Wed, 17 Dec 2008 18:09:17 +0000 Anti-Trend http://geekreport.com/?p=509 Guardian.co.uk is reporting on Microsoft’s humiliating decision to recommend that its customers forgo the use of Microsoft’s own Internet Explorer product. They are instead suggesting that Windows users make use of a more secure browser such as Firefox or Opera until they are able to patch the latest serious vulnerability in IE.

From the article:

The flaw in IE allows criminals to gain control of computers that have visited a website infected with malicious code designed to exploit it. While restricting web surfing to trusted sites should reduce the risk of infection, the malicious code can be injected into any website. Users do not have to click or download anything to become infected, merely visiting an infected website is sufficient.

Read More

]]> http://geekreport.com/509/microsoft-says-avoid-ie/feed 1 Use NoScript to protect yourself from Clickjacking http://geekreport.com/321/use-noscript-to-protect-yourself-from-clickjacking http://geekreport.com/321/use-noscript-to-protect-yourself-from-clickjacking#comments Fri, 26 Sep 2008 05:08:13 +0000 Anti-Trend http://geekreport.com/?p=321 With all the hubbub about Clickjacking (gag, buzzwords!), I thought it would be valuable to write a brief article on the topic.

What it is

Details are still being suppressed at this point, but it appears to be an IFRAME manipulation used to effectively cover a normal web link with a trusted site that appears good and proper, with a bad one to an attacker site. That is, in its currently disclosed form. The implication is that it could potentially be a lot nastier, maybe even 100% automated. In any case, this attack could conceivably be used for phishing or host exploitation.

Who it affects

Basically, any modern browser which supports IFRAMEs. This includes any reasonably current versions of IE, Firefox/Mozilla, Safari, Flock, Opera, etc. So, pretty much everybody. It doesn’t include browsers which don’t support IFRAMEs, such as lynx or elinks.

How to protect against it

Essentially, the fix will ultimately involve a re-thinking of how browsers (and perhaps web developers) handle IFRAMEs. In the meantime, you can provide yourself at least a modicum of protection by using the NoScript plugin.

  1. Download and install Firefox
  2. In Firefox, download and install the NoScript plugin
  3. Navigate in Firefox to Tools –> Addons
  4. Highlight NoScript and click Preferences
  5. Click the Plugins tab and make sure “Forbid IFRAME” is checked

Or, you can view our brief video tutorial here.

]]> http://geekreport.com/321/use-noscript-to-protect-yourself-from-clickjacking/feed 2