Internet Explorer Security Problem - Use Something Else.

[The Internet Bloke]

LO,

If you're still using Internet Explorer, I'd suggest that you immediately change over to Firefox, Opera, Chrome, etc.

A newly found flaw in all versions of Internet Explorer allows criminals to take over your computer, steal passwords, and do other unfriendly things.

Microsoft are working on the problem.

(This news is a few days old, but as there has been no mention here, I thought I'd do so)

cheers, Eric G.

References:
http://www.builderau.com.au/tag/brow...r-security.htm
http://news.bbc.co.uk/2/hi/technology/7784908.stm

[BrightSpark]

Microsoft released the patch for it today.

[gregpritchard.virtualcio]

I totally agree with The Internet Bloke - it is very wise to start looking at alternative browsers. For us, we've been using Firefox and Opera for a few years now.

Little do most realise, but there are many more browsers freely available. Check out this list http://en.wikipedia.org/wiki/List_of_web_browsers.

[Adam Randall]

Thats not to say that other browsers dont also have their fair share of problems, they are just not as popular as IE so the problems go under the radar.

To say IE is insecure when compared to other browsers is like saying Mike Tyson got knocked out by a punch so therefore cannot take a punch like the average person.
The fact he is/was a boxer and gets more punches thrown at him, so there is a higher likelyhood of him getting knocked out by a punch.

Maybe not the worlds best analogy but there you go!

Below items are all within the last few days.

Firefox Security Flaws Patched

Opera patches 'extremely severe' flaws

Safari and Chrome security problems criticised

Ultimately the more secure the browser, the less user friendly it will become, it always has and always will be a trade off.

[2way Technology]

If you seriously think this way in mind and you're that concerned about the flaw (which has been patched already - see Microsoft Security Bulletin MS08-078 - Critical: Security Update for Internet Explorer (960714) ) then you should probably not be using Windows at all. You know, thinking about that, there's also security flaws within Google's GMail - so you probably shouldn't be using that either. Given there's also security flaws in the iPhone, you should probably go back to using your old Nokia and next year all of the major Antivirus companies will have an AV client for Mac OS by next year so you should probably discontinue using Mac's also.

Internet Explorer has Security flaws (just like everything else), but if you read the article the most important peice of information is always ignored by everyone "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."

What that's saying is - if you're not operating your computer as an Administrator, then you'll be far less impacted. Infact, if you take a good look at the flaw and the malware/viruses/etc exploiting the flaw, you'll find that if you're not operating your computer as an Administrator, then you're not going to be affected at all because these exploits require Administrative level access to fully execute.

The real advice should be - Use your computer, don't Administer it.

If you don't have the expertise required to properly defend yourself from Internet threats, find someone who does and if your IT Service Provider makes your every day user account an Administrator, slap them as they're only doing themselves a service (by ensuring they need to return and repeatedly bill you for fixing your systems).


I'll finish this post off with a quote from Microsoft about 5 years ago.

Very few people are willing make the effort to eradicate the largest single reason that e-mail viruses and cracks in general are so dangerous: everyone logs in as a user who is a member of the local Administrators group… By running programs without Administrative privileges whenever possible, you ensure a more secure environment.

Developing Software in Visual Studio .NET with Non-Administrative Privileges

[Adam Randall]

Some good points, its great if a business will allow you to set all their users workstations to run in non administrative mode, however its not an easy path to convince someone its worth the investment in time and energy.

You can actually run a workstation in this way without a virus scanner or spyware scanner and it will be quite safe.

What would be great is if programs were written with this in mind.

MYOB, Quickbooks, Office, and every second third party app you can think of requires administritive privileges, and even if you do give full user access to the folder the program resides in, you find later it needs administritive privilege for 10 other files scattered throughout the operating system.
Then the client goes to add a printer!!
Steam comes out of their ears as you try and show them how to right click and run as administrator, they scream "Just damn well take all this rubbish off, I want my pc back the way it was, I dont care if its insecure"

Is it their fault when things go wrong and they get a virus or spyware? Yes it is, will they blame you for the problems when they do occur? most likely.
If people did the right thing with their computers, there would be a lot of unemployed computer technicians.

One day computers will be as complicated as the average toaster, they break and you will buy a new one.
Applications will be simple and will reach a level of usability that cannot be surpassed.
Thats the day I become unemployed.....

Now you opened the door to computer quotes I like quotes especially Microsoft ones.

"640 K ought to be enough for anybody."
-- Bill Gates, 1981

"The best way to prepare [to be a programmer] is to write programs, and to study great programs that other people have written. In my case, I went to the garbage cans at the Computer Science Center and I fished out listings of their operating systems." -- Bill Gates, OS/2 Notebook, Microsoft Press, 1990

"Microsoft's biggest and most dangerous contribution to the software industry may be the degree to which it has lowered user expectations."
-- Esther Schindler, OS/2 Magazine

"Microsoft Products are Generally Bug Free"
-- Bill Gates

[2way Technology]

MYOB >> Hasn't required Admin rights since v17

Quickbooks >> Also no longer requires Admin rights (used to)

Office >> Hasn't required Admin rights since Office 2000

Every second third party app you can think of requires administritive privileges

>> Whilst I partially agree with this - most of the small time developer nasty applications do require Admin rights... as a service provider it's our duty to advise the client of this situation so they completely understand and then source an alternative solution - which there always is an alternative.


>> oh, btw, network printers published via the Server/AD don't require admin rights to install. Infact, we install them as the user with their logon script so they don't even have to do it themself.


When ever our clients question the validity of the secured networks, we simply forward them the testimonials from our clients, some of whom are now into their 5th year and haven't experienced a single hour of downtime, a single malware or virus incident, then we point out how little reactive IT service we've sold them over the past year - usually doesn't take too long for them to realise they're making a mistake if they change their mind.

To date, we've only had one client want to revert back to having Administrative rights - since then (3 months ago) they've had more problems than they had in the first 2 years.

[2way Technology]

Something I probably should clarify.

With all of our clients environments, we use Managed Software Installation - i.e. Group Policy for the Deployment, which for most applications requires us to Repackage them into MSI.

During this repackaging process we unearth any hidden easter eggs (issues) when the product is executed by a non-admin. At this point we resolve the issues and make the software non-admin compliant before the software is deployed to the client.

[Adam Randall]

Not disagreeing with the methodology of running in standard user mode on the desktops at all, but there are many hurdles to overcome and that takes time.

Sometimes the client does not want to pay for that time, or they want to keep things the way they are for the time being.

An average network of 20 or 30 PCs might take 30-60 hours of time to pursuade, plan, test, excecute and educate the change the system requires.

Thats not an easy sell and you WILL have problems in any network that you did not anticipate even on networks you already manage. Staff will resent at some level that control is being taken away from them and you will have to manage this, which of course takes time.

Still the more you do something the better you become and it sounds like you have gotten into a pretty good routine of doing this.

[Adam Randall]

Originally Posted by 2way Technology

MYOB >> we simply forward them the testimonials from our clients, some of whom are now into their 5th year and haven't experienced a single hour of downtime

Thats beyond impressive, is that on the servers or workstations as well?
I have to get my hard drives from where you are shopping, we get a 5-10% failure rate on that component alone over a 3 year period.