Don Park's Daily Habit - Spoofing for Dummies

Signin

Feeds

RSS

Atom

Archives

2007

2006

2005

2004

2003

2002

Spoofing for Dummies

by Don Park at 2003/12/11 15:15:45

I had my doubts, but the URL spoofing bug in IE that Microsoft is supposedly investigating is really there. The link-happy blogosphere, filled with copy-and-paste addicts, is a ready victim to this bugger (via Zap The Dingbat).

The bug is caused by simply inserting '%01' in front of '@' character in URLs like foobar@blahblah.com to hide the real domain name from the fake one which goes in front of the '%01' (see the HTML source for this post).

As an architect, this sort of bugs takes a lot of energy out of me. Ever feel betrayed by the ground you walk on? It's like discovering that everything you designed was built on a gigantic turtle that just woke up. I have obviously exaggerated the size of the problem but this sort of bullshit just upsets my stomach.

Another thing that upsets my stomach is getting all excited enough about something to invest months into it just to wake up and realize that there is no reason for people to use it. There is a quite a bit of that in the web services and Atom hypes. Get in the habit of asking Why Would They? if you can't take the disappointments. IT is NOT about YOU, but ALL about THEM, the people who will be using what you build.

Update:

On my IE 6 running on XP with all the latest patches, this is what I see after pressing the "Test Exploit" button.

Comments

dda at 2003/12/12 12:21:56 AM

Sorry, doesn't work on my Mozilla 1.6a :-)

Arve at 2003/12/12 01:03:37 AM

Opera is not vulnerable. Upon clicking your test link, I get a "Security Warning. You are about to go to an address containing a username".

Don Park at 2003/12/12 02:00:16 AM

It's nice that Mozilla and Opera doesn't have the bug. Unfortunately, 90% of the web users are using IE. Like I wrote, it's not about YOU, the geeks who are informed and self-assured enough to change browsers, but THEM, the people who will just nod their head if someone tells them that not to point their fingers at the screen.

Jim at 2003/12/12 03:23:33 AM

just what is it susposed to look like? Your source comes through as this in both IE and Mozilla (bracket change):

Roger Benningfield at 2003/12/12 03:24:01 AM

Don: "IT is NOT about YOU, but ALL about THEM, the people who will be using what you build."

Shannon J Hager at 2003/12/12 04:07:54 AM

Disclaimer: for the last 4+ years, I have made EVERY SINGLE PENNY of my income using a Microsoft product. I am not anti-MS, an open source zealot, etc, etc.

Luke at 2003/12/12 04:51:21 AM

Agreed, there is absolutely no reason for you not to use Firebird. If IE is a turtle, it's one that's been sleeping for over a year and won't ever wake up. Even Microsoft said they won't be updating it. Firebird is a wonderful browser, Mozilla is great and I hear nothing but good about Opera. So why stay? Are there a million ActiveX pages you just simply have to view?

pb at 2003/12/12 07:02:39 AM

All of the browser makers have done virutally nothing to combat the increasing problem of spoof sites.

dj at 2003/12/12 07:46:19 AM

What is the connection between IE being insecure and Atom's development? This is a red herring. I also don't understand why you're so hell-bent on destroying Atom. I'm genuinely curious. If you're so sure it's insignificant, why not just ignore it until it goes away?

anonymous at 2003/12/12 07:57:46 AM

Upcoming Don Park posts:

Danny at 2003/12/12 08:12:53 AM

Funnily enough, a new draft of the Atom Format spec came out today, and an update to the API spec a few days ago.

Ole Eichhorn at 2003/12/12 08:50:31 AM

"IT is NOT about YOU, but ALL about THEM, the people who will be using what you build"

Derek Woolverton at 2003/12/12 09:48:39 AM

Hmmmm. What's Atom? Oh, nevermind, its probably not important. I'll just go back to actually getting work done...

Don Park at 2003/12/12 12:59:02 PM

1. I *do* use Firebird. It's not about me, but the people who use what I build that I worry about. That is my default perspective whenever I am talking about software.

Danny at 2003/12/12 01:58:44 PM

1. Good man.

Don Park at 2003/12/12 03:25:07 PM

Make sure you have the 'right end' of the lamb in your picture. :-p

mac at 2003/12/12 04:18:01 PM

http://www.microsoft.com%01@zapthedingbat.com/security/ex01/vun2.htm

Bill Brandon at 2003/12/12 06:22:25 PM

Any browser is likely to have security holes. Nobody (that you know about) is looking for the holes in Firebird, Opera, etc., that's all. The ones in IE are too much fun - you can mess with *90%* of the planet with them. But you can bet that in the coming months, you will hear about exploits involving at least one other browser.

Derek Scruggs at 2003/12/12 08:08:24 PM

Interestingly, the bug does not show up in MyIE2, which (I thought?) is just a shell around IE. The underlying browser is IE 6 on WInXP. But maybe I'm wrong...

Don Park at 2003/12/12 08:56:25 PM

The bug seems to be in IEXPLORE.EXE, not the IE browser control.

heavyboots at 2003/12/12 09:35:58 PM

Apple's Safari sees it correctly but doesn't get excited enough--I'd like it to warn me like Opera does. Heck, anytime an @ appears in a URL it should say something to the effect that "You are about to log in to the website scamzrus.com as user microsoft.com. Is this really what you wanted to do?" As for the 90% of the world using Windows IE, don't worry! They probably already have a virus or a keystroke watcher on their machine because they also use Outlook... ;-)

heavyboots at 2003/12/12 09:39:59 PM

Oops, actually when I *manually* paste the link into Safari it goes there and shows the whole link. Just clicking on the button doesn't do anything at all for some reason. But I still want my '@' warning.

Davide Inglima at 2003/12/13 11:19:03 AM

My IExplore.exe doesn't show the bug. I'm using the italian version on win2k.