IE zero-day flaws cry out for switch to Firefox
There’s no easy way to secure IE against similar flaws that will inevitably be discovered and used by hackers to their advantage in the future. For this reason and in response to pleas for help by many Pctipsbox readers here’s my recommendation on the best way to surf the Web more securely:
Step 1: Switch to Firefox, Opera, Chrome, or another contender and configure it to be your default browser. Use IE only to visit sites that require Microsoft-specific technology probably because they rely on ActiveX to function. (For example, you need to use IE to download patches at the Windows Update site.) I recommend Firefox because of the numerous add-ons available for that browser, some of which I describe in Steps 2 and 3.
Step 2: Install the Firefox add-ons known as User Agent Switcher (see UAS’s download page) and IE Tab (download page).
User Agent Switcher lets you change your browser’s identity. If a Web site demands the use of IE but actually works fine with other browsers, you can change the name of the operating system and browser the site thinks you’re using. Many “IE only” sites render perfectly well in Firefox and other browsers.
IE Tab lets you open a site in a new Firefox tab that’s driven by IE’s rendering engine. This allows sites requiring ActiveX or other IE-only components to work in the same way they do in IE itself.
Unfortunately, using the IE rendering engine in a Firefox tab leaves your PC just as susceptible as it would be if you’d opened an IE window in the first place. Use this technique with caution and only with sites you feel are very unlikely to be hacked, such as Microsoft.com.
Step 3: For added security, install the NoScript plug-in, which disables JavaScript, Flash, Silverlight, and other “active content” (see NoScript’s download page). Because most Web sites of any complexity use JavaScript for menus and other functions, place in the utility’s “whitelists” sites such as Microsoft.com and pctipsbox.com that are unlikely to try to run malicious scripts on you.
Step 4: Open an Internet Explorer window and set the security level of IE’s Internet zone to High. To do this, click Tools, Internet Options, Security. Choose the Internet zone in the box at the top of the dialog and move the slider control below it to High. Note that this setting will cause many sites you haven’t added to IE’s Trusted Sites zone to render incorrectly or display error messages.
Step 5: If for some reason you can’t install Microsoft’s Dec. 17 IE patch, refer to Microsoft’s Dec. 10 and Dec. 12 advisories for workarounds, as I mentioned above. The latter page, for example, describes how to adjust Access Control Lists by using Registry scripts in an oledb32.zip file you can download from Microsoft. (The download link is at the end of that page.)
Be aware that some of the workarounds Microsoft recommends can have unexpected side-effects. For example, a comment posted by the Internet Storm Center on Dec. 16 stated that Microsoft’s “Disable XML Island” workaround prevents users from sending e-mail using Exchange 2003 and Outlook Web Access.
If you need any more evidence that weaknesses in IE can be rapidly used by hackers, take a look at a wiki page provided by the Shadowserver Foundation, a security group that lists sites known to be infecting unsuspecting visitors.
IMPORTANT: Do not visit any of the sites on the list, even if you think your browser is secure these sites are or were infectious.
Tags: access, ActiveX, Agent, Browser, error, error message, Firefox, firefox add ons, Flash, hackers, Internet, internet explorer, javascript, Microsoft, Microsoft-specific, NoScript, patch, plug-in, Security, Switcher, tab, tools, update, Windows, windows update, windows update site
Loading ...
