RE: Re: Internet Explorer URL parsing vulnerability

[S G Masood <sgmasood () yahoo com>]

--- "Schmehl, Paul L" <pauls () utdallas edu> wrote:
> > -----Original Message-----
> > From: full-disclosure-admin () lists netsys com 
> > [mailto:full-disclosure-admin () lists netsys com] On
> Behalf Of 
> > S G Masood
> > Sent: Wednesday, December 10, 2003 12:01 PM
> > To: full-disclosure () lists netsys com
> > Subject: Re: [Full-disclosure] Re: Internet
> Explorer URL 
> > parsing vulnerability
> >
> > Hey, to be very honest, if this was 0day and the
> spoof was 
> > well constructed, even you and me would probably
> fall for it. ;D
> >
> Really?  I kind of doubt it, since I would never
> click on a link in an
> email message that had anything to do with financial
> matters.  I doubt
> that you would either - 0day or not.

I was not talking about spoofs of banking or financial
sites alone. There is a whole range of subtle social
engineering goals that you could accomplish with such
a spoof. For instance, the headline "Gnu Members
Combine Resources to Buy Out Microsoft" would look
pretty on http://Microsoft.com... :) Subtlety is the
key here.

Infact, you dont necessarily have "to click on a link
in an email message". There are a whole lot of other
ways to feed the URL to the victim which are even more
covert.

--
Masood

__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html