4 ms·
I take this claim with a pinch of salt. It's a neat idea: exploit IE to install a sniffer that picks up Gmail passwords etc. on the local network, but the only
by mootothemax 17y ago
I take this claim with a pinch of salt. It's a neat idea: exploit IE to install a sniffer that picks up Gmail passwords etc. on the local network, but the only "ultra sophisticated" bit of this I can tell is that the hackers did a really good job of covering their tracks.
The article mentions that your average cybercriminal is lazy, and I can believe that - you're only going to put as much time in to an attack that you're going to get out in financial reward. But if a commercial hack was going to bring about the same financial-level of reward, I bet the cybercriminals wouldn't be sloppy.
- sophacles 17y agoI had a similar train of thought, but in a slightly causality ordering: Places like google have a high potential for a high payout, and they know it. Therefore the cybersecurity is higher, requiring a better caliber of criminal.
- rquirk 17y ago"Although the initial attack occurred when company employees visited a malicious web site, Alperovitch said researchers are still trying to determine if this occurred via a URL sent to employees via e-mail or instant messaging or some other method, such as Facebook or other social networking sites." It still needed an employee to make the usual "install the dancing pigs"-style gaff while using IE6. Also: Employees using IE6, inside Google, in 2010. Why weren't they using Chrome?
- jsankey 17y agoAlso: Employees using IE6, inside Google, in 2010. Why weren't they using Chrome? I guess they were testing something in IE6. Perhaps one of their own sites. Perhaps how some other site renders in it compared to Chrome. Who knows.
- jauco 17y agoThat'd be brilliant! Send a bug report that your site renders incorrectly in chrome but correctly in IE6. That's an almost guaranteed hit with a known browser!
- sophacles 17y agoGood security is multi-layered. Just because they relied on an old trick to get their foot in the door, doesnt mean they have bad security inside or at more sensitive parts.
- jonknee 17y agoThe vulnerability was in IE 6, 7, and 8. "Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are affected." http://www.microsoft.com/technet/security/advisory/979352.mspx http://www.microsoft.com/technet/security/advisory/979352.ms...
- bayleo 17y agoTrue, it may not have been as ultra-sophisticated as the article lets on, but the fact that there would be no obvious reason to pursue the attack on 34 different companies seems to belie the commercial-hack theory.