EEEEK I found a big scary bug in ie!

[PeOfEo]

I have heard about the forced download in ie but here is how it works. If you make a page that lings the files 200+ times ie just assumes you want to download it downloads it. So if I were to put <iframe src="thefile.exe"></frame> 200 times you would be download my file. This file could be a trojan or a virus. This is yet another reason to move to mozilla firebird. Happy downloading!

[AdamGundry]

Would the following work, do you think?

<script type="text/javascript">
for (i=0;i<200;i++){
document.writeln('<iframe src="http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.5/mozilla-win32-1.5-installer.exe"></iframe>');
}
</script>

Adam :)

[PeOfEo]

heh, but lets run that loop server side just for the heck of it. That is a really good idea lol.

[AdamBrill]

Are you trying to say that it will just automatically download the .exe file and run it?? If so, ouch.

That could do some serious damage...

[PeOfEo]

I am saying just that! Its a very scary bug as the title suggests :p

[Aronya1]

I realize I'm coming late to this particular party, and please point out whatever I may be missing here, but downloading a file and executing a file are two very different things, are they not? Has anyone tried this?

[AdamBrill]

Hmm... I tried it, but it didn't download or execute the file. I don't know if I did something wrong or if it didn't work, but I'm hoping that it didn't work. lol

I just loaded 250 iframes with an .exe file in them. All it did was popup 250 download file dialog boxes... ;) It was fun closing all of those. :D

[Aronya1]

LOL!! :D

[PeOfEo]

heh, try it with regular frames next! Basically if its a virus or a trojan whos to say you would enitiaite it? The server end of a trojan just needs to be on your system right? And a virus can run at startup or something.

[Aronya1]

Nothing runs at startup that hasn't been configured to run. That requires making changes to the system in some way. Just downloading it to your computer won't make it run.

[PeOfEo]

but, when I get that stuid wild tangent on my system it seems to find its way into startup :rolleyes: It must be getting installed w/ some other software (spywhere like that comet cursor/tool bar stuff! Oh how I hate it!)

[Aronya1]

Originally posted by PeOfEo
It must be getting installed w/ some other software
Bingo!
But, you just confirmed what I was saying. You installed it, rather than just putting a file on your system.

What you said before is true, though: Basically if its a virus or a trojan whos to say you would enitiaite it?
LOTS of people are going to double-click a new icon on their desktop, just to see what it is. Then you're off & running...

[Compguy Pete]

wouldnt a good firewall and updated A/V app keep you safe?

I know in most of the recent worm attacks, my firewall kept the worms out.

[PeOfEo]

heh I had one on my router, but I turned it off. I need to play with it. I am in a dmz right now anyway so it would do me no good. I need to figure out how to keep it so I can connect on aim and run a server yet still be behind my firewall which masks my ports, and oh yea not have gaming problems. Dlink... secure... almost too secure for practical use, more of an inconveiniance at times.

[Compguy Pete]

it took me a long time to figure out the fact that I needed a firewall.

I only run A/V software because I have a household of users on my pc as well.

[jeff_archer7]

Quoting a friend who develops anti-virus for CA

***I possibly don't understand you here. Sounded to me that it will just make your page very slow. Can't harm anyone.
You possibly can drop an exe like that. There will be some restriction on what you can download. Even if you can force the download of the exe, it is another thing to run it.***

[AdamBrill]

Did anyone ever actually get this to work? I tried it and it didn't work for me. If anyone actually got it working(running the file or just downloading it), I would be extremely interested in seeing the page...

[Paul Jr]

Yeah, after I read this I tried it as well -- I got zilch.

[AdamGundry]

I can't get it to work either. I guess it either is a hoax, or only effects some versions of IE.

Adam

[PeOfEo]

Ill post the article link
http://www.securityfocus.com/archive/1/321532
I have heard about forced ie downloads from other sources though, I just never knew how to do it. So I know it is possible to do, weather this is how to do it is debatable because I did not try it.

[AdamBrill]

Well, the one in that link didn't work for me, and since I don't believe stuff on the internet until I see it(there are too many fakes), I had to go looking for an example... ;)

What I found makes me about ready to switch to FireBird. :D There actually was a site that, when I went on it, made an exe file run on my computer. I was shocked, but I am now absolutely positive that it can be done, since I saw it running right on my computer. They did it very similar to what PeOfEo first posted except they did it many more times. So rather than just sending the file 200 times, they sent it over 3,000 times. :eek: What they needed to do was swamp my processor until they reached the point where one of the file downloads would make it past without popping up the download box. It was really weird...

The only problem with it is if you don't just sit there pressing cancel on each of the download boxes, it won't happen. What you should do if hundreds of popup boxes start coming is stop it FAST. ;) If you have to hit the reset button(or yank the plug from the wall :p), that's better than downloading a virus. ;) I'm going to try to "tweak" my browser settings and see if I can get those set just right so it won't work... We'll see... ;)

BTW, PeOfEo, thanks for pointing this out. It makes me kinda nervous thinking that someone could have run an exe on my computer just because I went to their site. :)

[PeOfEo]

Well using internet explorere is not reccomended :D I only use it for testing purposes these days. Right now I use it for sites w/ applets too just because for some reason I can't get the java plugin to work on firebird, I have downloaded it but its not a dll etc.