Bugs, bugs, bugs…

Yesterday I spotted a link to an interesting site describing several unpatched bugs in Internet Explorer, from version 5 through the current version 6. As a natural-born evilHomoSapiens, I immediately thought of several ways to use those bugs. Yes, as of today I can snoop around the computer of “whomever I like.” I work at a company where IE 5.0 is the standard, meaning everyone uses the same version of the same browser (I hope I’m not giving away a company secret… :). That leaves me free to make mischief. Can you imagine what a worm could do if it used not only Outlook but also Internet Explorer to spread?

Here’s one realistic scenario. I set up a malicious page that pretends to be “my homepage” and send a few people there. The page uses two bugs, one to save a file on the local disk and the other to execute code. It’s easy enough these days to find a keylogger that can be packaged as an exe and install itself quietly just by being run. And that’s before we even get to Trojans…

Enough theory. Here’s the link to the site I mentioned. Enjoy.