Rob Franco and team - IE 7 Security
- Posted: Sep 15, 2005 at 6:24 PM
- 89,821 Views
- 26 Comments
Download
How do I download the videos?
- To download, right click the file type you would like and pick “Save target as…” or “Save link as…”
Why should I download videos from Channel9?
- It's an easy way to save the videos you like locally.
- You can save the videos in order to watch them offline.
- If all you want is to hear the audio, you can download the MP3!
Which version should I choose?
- If you want to view the video on your PC, Xbox or Media Center, download the High Quality WMV file (this is the highest quality version we have available).
- If you'd like a lower bitrate version, to reduce the download time or cost, then choose the Medium Quality WMV file.
- If you have a Zune, WP7, iPhone, iPad, or iPod device, choose the low or medium MP4 file.
- If you just want to hear the audio of the video, choose the MP3 file.
Right click “Save as…”
- Mid Quality WMV (Lo-band, Mobile)
- WMV (WMV Video)
There's a ton of new things in Internet Explorer 7.0 that'll improve your security. Meet the
IE team and learn what they are doing to protect computer users against phishing and malware and other kinds of attacks. For more about IE 7.0, visit the
IE team's blog.
The interviewer here is Joshua Allen, IE evangelist, and he is well-known because he was Microsoft's first blogger.
The interviewer here is Joshua Allen, IE evangelist, and he is well-known because he was Microsoft's first blogger.
Comments Closed
Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation,
please create a new thread in our Forums,
or
Contact Us and let us know.
Follow the Discussion
The sheer fact that it can't write a single thing to the hd without user approvable is enough for me to get me to switch back from Firefox.
In the video you show your evil activex control and what it does is issue the "format c:" command. Actually, this command will fail since the C drive is in use by the operating system and cannot be formated and since the format command needs confirmation before it formats a harddisk, although the latter might be bypassed I guess. However, you are the IE Security Team and I hope that you know this. After all, hacker do much worse things and I hope that you know much more than you are telling us on their methods and on all the harmful senarios that are out there. Because a simple format c: is nothing and you should know that. I hope that your internal testing examples are much more sofisticated than what you say publicly.
"Need to get a camcorder with a light"
[6]ROBERT
That was just a trivial example - it didn't matter what was in the file, just the fact that the control tried to write a file but IE7 didn't let it.
The pure evil movie, I have no idea, but this thing might know...
I can thing of one of the ghost busters sequels or Newman (from Seinfeld... he is pure evil)
pure evil:
Time Bandits? "Mum! Dad! Don't touch it! It's evil!"
Hi CDCer,
The IE team has been very well aware of the z-indexing issue with the select element. If you read the blog post from Chris Wilson on the IE team blog at http://blogs.msdn.com/ie/archive/2005/09/13/465338.aspx you'll see that this is on the list of issues being addressed in IE7.
Thanks
-Dave
There has been all this talk about running LUA/LUP whatever you want to call it.
But, my understanding was that in XP home there really was not security. Logins are strictly for profiling? You need XP Pro to restrict a certain user from writing or accessing certain parts of the system.
Can someone comfirm or deny this? Please show the work of your proff.
BOb
In Windows, the Explorer windows (aka shell windows), the navigation bar (back, forward, address / breadcrumb bar / search) is fixed at the top. IE will do the same, for consistency with the shell as well as anti-spoofing.
For IE7 on XPSP2, we're considering our options. In Beta 1, we've heard a lot of feedback from people who want the ability to move the toolbars around, including the menus and the navigation bar. So no "final answer" on this issue yet.
Doesn't toolbar customization make it harder to spoof the chrome?
I know when I'm surfing on a Mac, and a spoofed Windows dialog pops up, I get a good laugh.
Neelay
Great video. Learnt a lot of where you guys are going. I have to say that I expect to see many privilege escalation exploits next....better priv escalation exploits than remote exploits that run under admin privs automatically....
...in the video you were referring to sending in exploits and vulnerabilities, so you guys can verify the threat model of IE. Is the threat model of IE published somewhere? I think if it is would give the security research community a more direct way to probe it for weaknesses...
Thanks -
Christian
-----
http://www.mcs.vuw.ac.nz/~cseifert/blog/index.php
Tell me about it. IE7 is in the wild, and I'm still having to workaround 10 year old z-index bugs. Every other browser seems to work with CSS.
You guys always deliver useful content. Awesome post. Very interesting and valuable videos. Keep posting more articles. Thanks for sharing useful info.
Remove this comment
Remove this thread
close