[MERGED] Website Virus warning

[basa]

From The Register !!

[MetaWraith]

Just been reading that.
Dusts off the install disk for Mosaic, an old text only browser.

There will always be people who try and subvert technology for their own ends.

What scares me though is the number of people / companies without adequate protection for their computer systems. Even with the publicity surrounding the big viral/trojan attacks, people still do not take reasonable steps to make sure they are uptodate and protected.

Lets face it, the vast majority of people are ignorant of the risks to their computers from infection. Dont have a clue about security, and from my own experience dont give a monkies. Yes people need to be educated, but thats highly unlikely to take place. Its only when they are infected, and can brouse etc that they start to take notice.

[Caspar]

Home users, meanwhile, should shut down options like ActiveX on Internet Explorer, which is a mechanism used by malicious code to upload onto PCs. Some experts have gone as far as to recommend that users switch to Opera, Safari, Netscape or Mozilla, Internet Explorer's rival browsers.

The article finishes off with that. First of all I do admit I use everything MS, even have a MS controlled kettle!
...but articles likes these make me suspect that they are attempts to scare people into using an alternative browser, and other suites.

There's no pinpoint evidence that IIS has problems, beyond patched fixes, according to the article. I'm no fool and am aware that software, ALL software contains bugs... and MS are nothing special in this dept.

The main reason why we hear about it so much is cause people love to hate them!!!

I do sometimes hear about Linux being hacked, or needed to be patched ASAP.... If people liked RedHat as much as they do MS...I suspect we'd have security questions being asked about RedHat too!!!

[Richard M]

Early this morning I gave Caspar a heads up on this because he works with Windows servers but I just saw this article and now apparently the Department of Homeland Security are getting involved.
http://www.theregister.co.uk/2004/06...hits_websites/

The article is wrong though:

For website proprietors, the best defence is to ensure that Web servers are fully patched and guarded against all attacks - particularly those running Internet Information Server (IIS), which seems to be a favourite of attackers due to previously revealed vulnerabilities.

The code infects patched IIS servers:
http://isc.sans.org/diary.php?date=2004-06-24

Home users, meanwhile, should shut down options like ActiveX on Internet Explorer, which is a mechanism used by malicious code to upload onto PCs. Some experts have gone as far as to recommend that users switch to Opera, Safari, Netscape or Mozilla, Internet Explorer's rival browsers.

More here:
http://slashdot.org/article.pl?sid=0...tid=172&tid=95

[Caspar]

Thanks for PM about this Richard


We've been discussing it here:
http://www.cableforum.co.uk/board/sh...ad.php?t=13945