IE6 hit by keystroke-capture hole

**Glaswegian** · 06-27-2008, 12:46 PM

Researchers have warned that an unpatched cross-site scripting bug in Internet Explorer 6 (IE6) could be used by hackers to capture keystrokes and steal other information.

The vulnerability appears to be a variation of a vulnerability first discussed by researchers Manuel Caballero and Fukami at Microsoft's on-site BlueHat security conference early last month, Yichong Lin, an analyst at McAfee, said in an entry to the company's blog.

At BlueHat, Caballero, who has worked for Microsoft as an independent penetration tester, said he had found a way to capture every browser action, including keystrokes used to type passwords. In a videotaped interview that Microsoft conducted during BlueHat, Caballero said that the combination of Flash and any browser, not just IE, could be hacked with a malicious script to give attackers full access to the browser.

http://www.techworld.com/security/ne...&NewsID=102029

Details of the recent variant, as well as proof-of-concept code, were posted to a Chinese-language security e-zine by a group calling itself "Ph4nt0m Security Team," according to another alert issued by the Danish vulnerability tracking firm Secunia.

06-27-2008, 12:46 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,334 OS: Win XP Pro SP3 My System Blog Entries: 10	IE6 hit by keystroke-capture hole Researchers have warned that an unpatched cross-site scripting bug in Internet Explorer 6 (IE6) could be used by hackers to capture keystrokes and steal other information. The vulnerability appears to be a variation of a vulnerability first discussed by researchers Manuel Caballero and Fukami at Microsoft's on-site BlueHat security conference early last month, Yichong Lin, an analyst at McAfee, said in an entry to the company's blog. At BlueHat, Caballero, who has worked for Microsoft as an independent penetration tester, said he had found a way to capture every browser action, including keystrokes used to type passwords. In a videotaped interview that Microsoft conducted during BlueHat, Caballero said that the combination of Flash and any browser, not just IE, could be hacked with a malicious script to give attackers full access to the browser. http://www.techworld.com/security/ne...&NewsID=102029 Details of the recent variant, as well as proof-of-concept code, were posted to a Chinese-language security e-zine by a group calling itself "Ph4nt0m Security Team," according to another alert issued by the Danish vulnerability tracking firm Secunia. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs