IE "phishing" vulnerability

[Paul Adams]

)The Register Article

Apparently inserting a hex code for "1" in a URL prevents IE from disaplying anything after it, so the good ol' "dupedsite.com@dodgysite.com" method of sending users to places they didn't want to go to is now not easily detectable.

Be aware, and I would hope a speedy hotfix is imminent...

(Cue replies of "everyone should use [insert alternative browser here]"

[Moby-Dick]

thanks Paul - let hope windows updates does its job on this one

[directhex]

everyone should use Mozilla Firebird!

[DaBeeeenster]

Agreed DH. Firebird rules. And I've moved over to Thunderbird 0.4 for mail and that rules too!

This is a REALLY NASTY bug. I can see a major news story coming out of this; it would be VERY easy to hack someone with this...Especially social engineering hacks...

[directhex]

so far 0.4 has been less stable than 0.3, and broken skin compatability. i'm not a happy bunny...

[Angus]

have started using tbird but it won't let me export my mail to anything else so I'm stuck forever.

Would be better if it could interface with pdas and the like.

[Richie]

If you right click the link and choose "copy shortcut" then paste it into the address bar WITHOUT hitting return then the full address including the "malicious" bit will be shown with the %00 or %01 codes

[directhex]

Originally posted by jaow83
have started using tbird but it won't let me export my mail to anything else so I'm stuck forever.

Would be better if it could interface with pdas and the like.

it stores all mail in standard UNIX MBOX format. anything which can import MBOX (and for reference, Eudora also uses this format) can import mail form Thunderbird. Mail is stored in C:\Documents and Settings\username\Application Data\Thunderbird\Profiles\default\randomvalue\Mail\server

[Paul Adams]

Lloyds TSB new target for phishing scam...

I got this email and to a layman it might look very convincing - the links even point to "online.lloydstsb.co.uk" (not obfuscated).

I hope they catch the bastards doing this and nail their nads to the wall.

[Moby-Dick]

Paul your posting your URLs the wrong way round , its description 1st then link ;-)

[Paul Adams]

Gah!
Thanks

I know exactly why I do it too - I use a friend's forum a lot, and posting links on there is that way round, so it's force of habit (I really should read the prompts, eh? ).

[Angus]

Originally posted by directhex
it stores all mail in standard UNIX MBOX format. anything which can import MBOX (and for reference, Eudora also uses this format) can import mail form Thunderbird. Mail is stored in C:\Documents and Settings\username\Application Data\Thunderbird\Profiles\default\randomvalue\Mail\server

I tried importing the mail into outlook as eudora mail and it didn't want anything to do with it. Also tried netscape communicator. no luck.

have scoured the tbird forums for a solution - so looks like i'm stuck with it until they release a version that includes export functions.