Yet another bug has been found in Microsoft’s Internet Explorer browser,
this one said to potentially allow the theft of data from consumers who are
banking online or shopping at e-commerce Web sites.
Microsoft is investigating, but has yet to make a formal
statement or issue a fix. One security expert was quoted as saying that “the
cryptographic protections of SSL don’t work if you’re a Microsoft IE user.”
The loophole could allow hackers to trick computer users into thinking they
are shopping at legitimate Web sites, exposing their credit card numbers and
other personal information.
The flaw was discovered by Mike Benham, a San Francisco programmer who
posted
a note to the Bugtraq mailing list on the SecurityFocus Internet site,
outlining what he called the possibility of an undetected “man in the
middle”
attack.
Some security experts said it was a serious concern; others were quoted as
saying that the complexity and knowledge required to exploit the
vulnerability makes the probability of widespread attacks unlikely.
Benham said in his warning that Internet Explorer versions 5.0, 5.5 and 6.0
have loopholes in handling digital certificates, such as those from VeriSign , which verify Web sites as being legitimate and also
include unique code for encrypting information.
Essentially, any Web site operator with a valid certificate could pretend to
be any other Web site operator, Benham said.
“I would consider this to be incredibly severe,” Benham said in his posting.
“Any of the standard connection hijacking techniques can be combined with
this vulnerability to produce a successful man in the middle attack.”
Netscape has no such loophole, he said.
Microsoft reportedly is still investigating and is unsure even whether to
call it a vulnerability, Scott Culp, manager of Microsoft’s Security
Response
Center, was quoted as saying. However, Microsoft and VeriSign were said to
be
working together on the matter and a VeriSign spokesman said that no real
cases have been reported in which someone has successfully spoofed a Web
site
or gained information.
Internet Explorer has a long history of security flaws, almost all of which
have been patched at one time or another.
