Microsoft patches IE, but Firefox is still safer

Give your friends secrets as free holiday gifts

By Brian Livingston

In celebration of the holiday season, we’re letting you send all of your friends the paid version of the Windows Secrets Newsletter absolutely free for the next three full months.

The other writers here say I’m crazy, but with the global economic slowdown we’re in, I want to spread a little cheer and let you treat as many people as you like.

Here’s how our holiday giveaway works:

• Step 1. Send the following URL in the text of an e-mail message to everyone you’d like to give, as a free gift, the paid version of the newsletter:

  http://WindowsSecrets.com/holidaygift

  You can include any text you like that will explain to your friends that they can get the paid version of this newsletter absolutely free as a gift. Please don’t spam a bunch of strangers — just send your message to your friends, people who regularly receive e-mail from you.

• Step 2. The holiday gift is only for people who’ve never had a subscription before.
• Step 3. People who visit the link and enter a valid e-mail address by Dec. 31, 2008, will receive a confirmation message. They must click a link in that message to verify their address and begin their subscription.

What do you get out of this holiday giveaway?

Just the satisfaction of knowing you gave something of value to people you care about. That’s the true spirit of the holiday season.

This crazy idea is a one-time thing. We may never repeat it. It’s just a spur-of-the-moment response to the economic times we’re living in.

I hope you’ll enjoy giving this away as much as I’ve enjoyed ignoring everyone who told me it would never work. Please have a happy and safe holiday season.

Special news update for MS patch; no paid version

We’re bringing you today a special report by Windows Secrets contributing editor Mark Edwards on a crucial Microsoft patch for Internet Explorer. The security threat that this patch is designed to correct has already affected millions of people.

Our next regularly scheduled newsletters will be published on Dec. 18 and Jan. 8. We skip publication during the last two weeks of December, so there won’t be any newsletters on Dec. 25 or Jan. 1.

News updates have no paid content, and all subscribers receive the same short message.

Brian Livingston is editorial director of WindowsSecrets.com and co-author of Windows Vista Secrets and 10 other books.

Microsoft patches IE, but Firefox is still safer

By Mark Joseph Edwards

Microsoft recently announced that a special, out-of-cycle patch would be released on Dec. 17 for Internet Explorer’s latest security vulnerability, the so-called XML exploit.

If you’d like to avoid similar weaknesses that are certain to be discovered in IE in the future, the simple solution is to use a different browser, such as Firefox, with a few easy customizations that allow you to switch to Microsoft’s browser only for sites that absolutely require IE.

If you haven’t yet patched IE to protect against the XML exploit, visit Microsoft’s December 2008 security advisory. This Web page, which began as an announcement of the Redmond company’s planned patch, changes automatically to information about installing the patch as soon as the fix is released.

WS contributing editor Susan Bradley reported on the dangerous zero-day exploit in her Dec. 11 Patch Watch column (paid content). The security hole affects many different builds of IE 5, 6, and 7 as well as the beta version of IE 8. Every recent version of Microsoft’s operating system is potentially affected: Windows 2000, XP, Vista, Server 2003, and Server 2008.

The Redmond software giant acknowledged on Dec. 16 that more than two million Windows users had already become infected via the IE flaw, according to an article by the Press Association. How many more people will get hit before the patch is widely distributed is anyone’s guess.

Microsoft published a security advisory on Dec. 10, listing nine potential workarounds, before the patch became available. Many people, myself included, felt that the explanation did a poor job of clarifying which combination of fixes a particular user should implement. The company’s Security Vulnerability Research and Defense blog attempted to clarify matters on Dec. 12. But the information there still left most people wondering how to determine the best combination of workarounds for their systems.

IE zero-day flaws cry out for switch to Firefox

There’s no easy way to secure IE against similar flaws that will inevitably be discovered and used by hackers to their advantage in the future. For this reason — and in response to pleas for help by many Windows Secrets readers — here’s my recommendation on the best way to surf the Web more securely:

• Step 1: Switch to Firefox, Opera, Chrome, or another contender and configure it to be your default browser. Use IE only to visit sites that require Microsoft-specific technology — probably because they rely on ActiveX to function. (For example, you need to use IE to download patches at the Windows Update site.) I recommend Firefox because of the numerous add-ons available for that browser, some of which I describe in Steps 2 and 3.
• Step 2: Install the Firefox add-ons known as User Agent Switcher (see UAS’s download page) and IE Tab (download page).

  User Agent Switcher lets you change your browser’s identity. If a Web site demands the use of IE but actually works fine with other browsers, you can change the name of the operating system and browser the site thinks you’re using. Many “IE only” sites render perfectly well in Firefox and other browsers.

  IE Tab lets you open a site in a new Firefox tab that’s driven by IE’s rendering engine. This allows sites requiring ActiveX or other IE-only components to work in the same way they do in IE itself.

  Unfortunately, using the IE rendering engine in a Firefox tab leaves your PC just as susceptible as it would be if you’d opened an IE window in the first place. Use this technique with caution and only with sites you feel are very unlikely to be hacked, such as Microsoft.com.

• Step 3: For added security, install the NoScript plug-in, which disables JavaScript, Flash, Silverlight, and other “active content” (see NoScript’s download page). Because most Web sites of any complexity use JavaScript for menus and other functions, place in the utility’s “whitelists” sites such as Microsoft.com and WindowsSecrets.com that are unlikely to try to run malicious scripts on you.

  WS associate editor Scott Dunn wrote more about NoScript and other Firefox security add-ons in his Apr. 17, 2008, lead story.

• Step 4: Open an Internet Explorer window and set the security level of IE’s Internet zone to High. To do this, click Tools, Internet Options, Security. Choose the Internet zone in the box at the top of the dialog and move the slider control below it to High. Note that this setting will cause many sites you haven’t added to IE’s Trusted Sites zone to render incorrectly or display error messages.
• Step 5: If for some reason you can’t install Microsoft’s Dec. 17 IE patch, refer to Microsoft’s Dec. 10 and Dec. 12 advisories for workarounds, as I mentioned above. The latter page, for example, describes how to adjust Access Control Lists by using Registry scripts in an oledb32.zip file you can download from Microsoft. (The download link is at the end of that page.)

  Be aware that some of the workarounds Microsoft recommends can have unexpected side-effects. For example, a comment posted by the Internet Storm Center on Dec. 16 stated that Microsoft’s “Disable XML Island” workaround prevents users from sending e-mail using Exchange 2003 and Outlook Web Access.

If you need any more evidence that weaknesses in IE can be rapidly used by hackers, take a look at a wiki page provided by the Shadowserver Foundation, a security group that lists sites known to be infecting unsuspecting visitors. IMPORTANT: Do not visit any of the sites on the list, even if you think your browser is secure — these sites are or were infectious.

The point is that thousands of sites became carriers within days. (The Press Association quotes Trend Micro as saying more than 10,000 sites were compromised by Dec. 16.) If you use a URL filtering system or block list, you should add the sites cited by Shadowserver to prevent access — at least until all your machines are patched or a specific site is proved to be clean.

Mark Joseph Edwards is a senior contributing editor of Windows IT Pro Magazine and regularly writes for its Security Matters blog. He’s a network engineer, freelance writer, and the author of Internet Security with Windows NT.