38

No that is not a security risk. Having stored passwords in a browser is a security risk. Letting an attacker access your computer between when you've typed in the password and before it is submitted is a security risk (and even after you've submitted it, you need to worry about theft of valid session cookies). Being able to jump to blanks/special ...


37

The main problem is probably that an IE from that era would like to support SSL 2.0, and, therefore, sends its initial message (ClientHello) in SSL 2.0 format, which has about nothing in common with the ClientHello of later protocol versions (SSL 3.0 and all TLS versions). That allowed the browser to connect to a server that knew SSL 2.0 but nothing else, ...


25

Internet Explorer is tied directly to the Windows operating system. It is essentially an extension of normal File window. Many of the operations performed by Internet Explorer call directly into Windows services. For example, the SSL/TLS implementation for Internet Explorer is performed in the LSASS (Local Security Authority Subsystem Service). So any ...


22

You can't. The best you can do is to use SSL sitewide. Have all HTTP connections immediately redirect the user over to HTTPS (redirect over to the front page via HTTPS, e.g., http://www.example.com/anything.html should redirect to https://www.example.com/). Don't serve any content over HTTP (other than an immediate redirect to your front page, over HTTPS)....


19

Yes, is a security risk, but exploiting it is very unlikely. It can be exploited this way: Someone uses your computer without you around Have enough time to open IE Connects to a website with a saved password Gets the profile of your password and goes away If the intruder have enough time to do all the above, it would be way faster and simpler to download ...


15

Applications that are signed with a standard code signing certificates need to have a positive reputation in order to pass the Smart Screen filter. Microsoft establishes the reputation of an executable based upon the number of installations world wide of the same application. Since you haven't published your application as yet (and therefore the reputation ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


9

The password is not displayed on screen to avoid shoulder-surfing attacks but it is still of course known to the browser. When you use a password store, it gives the actual password to a requesting application and not a hash or encrypted version of it (that'd be very untractable to use). If someone is close enough to you that they can use your keyboard to ...


8

On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed. If the machine is "shared" then there is no really good solution: if an hostile entity ...


8

A website implements HSTS by sending a Strict-Transport-Security header. A browser that doesn't understand the header will simply ignore it, just like any other custom or malformed header. Will there be any impact on the site? The impact will be that the user becomes vulnerable to attacks that HSTS is supposed to protect against (i.e. HTTPS downgrade ...


7

Security risk? You're leaking data, so yes it is definitely a security risk. But risk is the chance of it happening times the impact. The chance is low because it's not every day that you are typing in a password and then leave before logging in. The impact is also low because it's often much easier to just reveal the field's value (especially in browsers) ...


7

My German is pretty rusty, but I'm pretty sure the article from Heise Security doesn't really say what the H-online article claims. Unter Opera erreicht man die Plugin-Verwaltung durch die Eingabe von opera:plugins in die Adressleiste. Beim Internet Explorer genügt das Deaktiveren der Plug-ins unter "Add-Ons verwalten" nicht. Wer den IE einsetzt, sollte ...


7

Obviously there is no way for you to prevent an attack that would happen before the traffic even arrives at your server. You're just not in a position to have any affect at that point. However, one thing you can do to prevent non-SSL traffic from ever being sent is to intentionally break non-SSL links. As webmaster will typically test their links at least ...


6

HSTS is the only protection against SSLStrip, however you can take the following precautions to help prevent attack: Make sure your web application is free of Mixed Content vulnerabilities. This really goes beyond HSTS because doesn't protect against pulling JavaScript over HTTP from other domains. A common solution to security problems is EDUCATION. ...


6

The simple answer is that any malware that exploited your computer could potentially change a browser homepage. In fact it is easier to do that than a lot of more serious exploits so this may be all it has done. It could have been a co-worker out to cause trouble or mischief. The problem is that aside from carrying out a bit of forensic analysis, you can't ...


6

If you just want to know if one DLL supports ASLR, then load it into CFF Explorer, go to the Optional Header section, then click on the DllCharacteristics row. If "DLL can move" is checked, then it's ASLR-enabled, otherwise it's not. If you want to do a lot of them, I would write a Python script that enumerates all DLLs in a target directory, then checks ...


6

There might be more reasons, I'll just list a few that came up my mind: When establishing the SSL/TLS connection (the handshake) the client sends a list of cipher suites to the server. The server's responsibility is then select the one which will be used. In case there is no suitable cipher, the connection is terminated. SNI - Server Name Indication ...


6

Is this a known feature? Yes. How IE can know my file browsing history? As mentioned in the answer by RoraZ, Internet Explorer is (or at least, was originally designed as) largely an extension of the system file browser (explorer.exe), and they share many components and operations. Specifically, what you're seeing is that Internet Explorer is ...


6

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap". As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By ...


5

They are designed specifically to not allow this. As you brought up yourself, that would be a massive security risk. If you want to be able to browse your own systems without clicking "confirm security exception" a million times, add the certificates to your trust store on your computer, using the "Certificates" MMC snap-in. This can be done even better ...


5

The 'Clear SSL State' button is there to purge the SSL cache of selected Client Certificates used for authenticating to SSL-based services. It's just there to make client-certificates work faster (partly by remembering which certificate you used to authenticate to a certain site). It doesn't cache previously seen SSL certificates. Outlook+Exchange can use ...


5

Thanks to @Polynomial for that excellent pefile module suggestion. I threw together a quick python script to do this. There is probably room for improvements but it seems to work decently enough. import argparse import os import pefile class DllCharacteristics(): def __init__(self): self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False ...


5

As I guess you know, "Spartan" was developed in parallel to Internet Explorer 11. On April 29, 2015, during the Build Conference keynote, it was announced that "Spartan" would officially be known as Microsoft Edge. Internet Explorer was the default web browser for the earlier versions of Windows 10, but after the Windows 10 Anniversary Update on August 2, ...


5

I would suggest using Firefox with NoScript or comparable setup. NoScript allows you to monitor scripts loaded from websites and selectively allow certain JavaScript to run. That way you can avoid dubious scripts from running. It is especially useful as many malware is not hosted on the website itself , but often through ads or other third party content. ...


4

I don't use internet explorer myself, and without knowing what kind of proxy your network is using I can only give the vaguest of answers, but here goes: If your network contains a proxy and your browser is configured to use said proxy for https traffic, then anyone with admin access to the machine said proxy is running on can theoretically reconfigure the ...


4

On the page you linked you can find the CVE ID of the vulnerability: CVE-2014-1776. This is the most likely way different people will refer to the same vulnerability and nearly everyone talking about it will include this ID. A search for that ID finds many people talking about it but the explanation from Symantec seems most suited to a 6-year-old. FireEye ...


4

Normally, SSL management is per process. The SSL implementation DLL will, for instance, remember SSL sessions and be able to negotiate abbreviated handshakes (that's when a client reconnects to a server, and they agree to reuse the symmetric shared secret they established in a previous connection). Internet Explorer now has the habit of spawning several ...


4

Disabling the add-ons is not enough. CERT writes in one of its vulnerability notes: Disable the Java plug-in and Java Deployment Toolkit for Internet Explorer Disabling the Java plug-in for Internet Explorer is significantly more complicated than with other browsers. There are multiple ways for a web page to invoke a Java applet, and multiple ways ...


4

Some companies have proxy servers that perform a MITM attack on all https traffic going through a company. So while SSL3 may be disabled on your browser, it might not be disabled on the proxy server, and the proxy server is what establishes the SSL connection to the test servers you're accessing. If that's the case, you need to update your proxy server to ...


Only top voted, non community-wiki answers of a minimum length are eligible