Comment Feed for Channel 9 - Rob Franco and team - IE 7 Security http://ecn.channel9.msdn.com/o9/previewImages/100/113117_100x75.jpg Channel 9 - Rob Franco and team - IE 7 Security There's a ton of new things in Internet Explorer 7.0 that'll improve your security. Meet the IE team and learn what they are doing to protect computer users against phishing and malware and other kinds of attacks. For more about IE 7.0, visit the IE team's blog.The interviewer here is Joshua Allen, IE evangelist, and he is well-known because he was Microsoft's first blogger. en Tue, 18 Jun 2013 20:44:17 GMT Tue, 18 Jun 2013 20:44:17 GMT Rev9 Re: Rob Franco and team - IE 7 Security
The sheer fact that it can't write a single thing to the hd without user approvable is enough for me to get me to switch back from Firefox.

posted by DevilsRejection

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624418100000000 Fri, 16 Sep 2005 04:30:10 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624418100000000 DevilsRejection Re: Rob Franco and team - IE 7 Security In the video you show your evil activex control and what it does is issue the "format c:" command. Actually, this command will fail since the C drive is in use by the operating system and cannot be formated and since the format command needs confirmation before it formats a harddisk, although the latter might be bypassed I guess. However, you are the IE Security Team and I hope that you know this. After all, hacker do much worse things and I hope that you know much more than you are telling us on their methods and on all the harmful senarios that are out there. Because a simple format c: is nothing and you should know that. I hope that your internal testing examples are much more sofisticated than what you say publicly.

posted by nektar

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624590110000000 Fri, 16 Sep 2005 09:16:51 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624590110000000 nektar Re: Rob Franco and team - IE 7 Security "Need to get a camcorder with a light"


[6]ROBERT


posted by johnbrien

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624631220000000 Fri, 16 Sep 2005 10:25:22 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624631220000000 johnbrien Re: Rob Franco and team - IE 7 Security

posted by Escamillo

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624640540000000 Fri, 16 Sep 2005 10:40:54 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624640540000000 Escamillo Re: Rob Franco and team - IE 7 Security
nektar wrote:

In the video you show your evil activex control and what it does is issue the "format c:" command. Actually, this command will fail since the C drive is in use by the operating system and cannot be formated and since the format command needs confirmation before it formats a harddisk, although the latter might be bypassed I guess. However, you are the IE Security Team and I hope that you know this. After all, hacker do much worse things and I hope that you know much more than you are telling us on their methods and on all the harmful senarios that are out there. Because a simple format c: is nothing and you should know that. I hope that your internal testing examples are much more sofisticated than what you say publicly.



That was just a trivial example - it didn't matter what was in the file, just the fact that the control tried to write a file but IE7 didn't let it.

posted by Wells

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624648650000000 Fri, 16 Sep 2005 10:54:25 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624648650000000 Wells Re: Rob Franco and team - IE 7 Security The pure evil movie, I have no idea, but this thing might know...
I can thing of one of the ghost busters sequels or Newman (from Seinfeld... he is pure evil)

posted by TheAsher

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624686230000000 Fri, 16 Sep 2005 11:57:03 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624686230000000 TheAsher Re: Rob Franco and team - IE 7 Security posted by CRPietschmann

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624807480000000 Fri, 16 Sep 2005 15:19:08 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624807480000000 CRPietschmann Re: Rob Franco and team - IE 7 Security

posted by Kollner

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624833700000000 Fri, 16 Sep 2005 16:02:50 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624833700000000 Kollner Re: Rob Franco and team - IE 7 Security

posted by mycroft

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624921210000000 Fri, 16 Sep 2005 18:28:41 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624921210000000 mycroft Re: Rob Franco and team - IE 7 Security pure evil:

Time Bandits?  "Mum!  Dad!  Don't touch it! It's evil!"

posted by Maurits

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624929170000000 Fri, 16 Sep 2005 18:41:57 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624929170000000 Maurits Re: Rob Franco and team - IE 7 Security posted by scobleizer

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624937860000000 Fri, 16 Sep 2005 18:56:26 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632624937860000000 scobleizer Re: Rob Franco and team - IE 7 Security A brutal solution to the IE z-index bug for more details and try to fix it. the world can't afford to fight with the bug for another 10 years! Speaking about bugs, here is another one: While poking around MSN, I did a search for MSN sucks, and found a grand total of 49 pages! Yes, you heard it right, it's 49 pages, not 49K. As you can imagine, there is no way that I could trust that number, so I immediately checked with Google and got over 2 million results, and the same search by Yahoo! reports 3.7 million! But wait, it got much worse! Please read Bug or censorship in MSN search for the whole story. These issues cost the industry countless hours of lost productivity (100s of millions hours per year by some estimation) and really make Microsoft look so incompetent and evil in the eyes of geeks.

posted by The CDCer

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628298020000000 Tue, 20 Sep 2005 16:16:42 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628298020000000 The CDCer Re: Rob Franco and team - IE 7 Security posted by The CDCer

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628300320000000 Tue, 20 Sep 2005 16:20:32 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628300320000000 The CDCer Re: Rob Franco and team - IE 7 Security
The CDCer wrote:
It's great that you guys are working hard on security issues, but it's equally important to fix IE bugs. The z-index bug is a well know CSS bug since IE 4 or 5 nearly a decade ago with no easy cross-platform workaround, and it looks that the IE 7 team are still not aware of the problem. Please read <a href='http://cdcer.com/?2005/09/brutal-solution-to-ie-z-index-bug.html'>A brutal solution to the IE z-index bug</a> for more details and try to fix it. the world can't afford to fight with the bug for another 10 years! Speaking about bugs, here is another one: While poking around MSN, I did a search for <a href='http://search.msn.com/results.aspx?q=MSN+sucks&srch_type=0&FORM=QBRE'>MSN sucks</a>, and found a grand total of 49 pages! Yes, you heard it right, it's 49 pages, not 49K. As you can imagine, there is no way that I could trust that number, so I immediately <a href='http://www.google.com/search?num=100&hl=en&lr=&safe=off&c2coff=1&q=MSN+sucks&btnG=Search'>checked with Google</a> and got over 2 million results, and the <a href='http://search.yahoo.com/search?p=MSN+sucks&prssweb=Search&ei=UTF-8&fr=ush-help&fl=0&x=wrt'>same search by Yahoo!</a> reports 3.7 million! But wait, it got much worse! Please read <a href='http://cdcer.com/?2005/09/bug-or-censorship-in-msn-search.html'>Bug or censorship in MSN search</a> for the whole story. These issues cost the industry countless hours of lost productivity (100s of millions hours per year by some estimation) and really make Microsoft look so incompetent and evil in the eyes of geeks.


Hi CDCer,
The IE team has been very well aware of the z-indexing issue with the select element. If you read the blog post from Chris Wilson on the IE team blog at http://blogs.msdn.com/ie/archive/2005/09/13/465338.aspx you'll see that this is on the list of issues being addressed in IE7.

Thanks
-Dave

posted by DMassy

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628362170000000 Tue, 20 Sep 2005 18:03:37 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632628362170000000 DMassy Re: Rob Franco and team - IE 7 Security
There has been all this talk about running LUA/LUP whatever you want to call it.

But, my understanding was that in XP home there really was not security. Logins are strictly for profiling? You need XP Pro to restrict a certain user from writing or accessing certain parts of the system.

Can someone comfirm or deny this? Please show the work of your proff.

BOb

posted by pilotbob

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632629579620000000 Thu, 22 Sep 2005 03:52:42 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632629579620000000 pilotbob Re: Rob Franco and team - IE 7 Security

posted by ChrisD

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632633025580000000 Mon, 26 Sep 2005 03:35:58 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632633025580000000 ChrisD Re: Rob Franco and team - IE 7 Security can i recomend  you  use a Monopod  or a Tripod...for the Camera Smiley). Just to point out  i have some of your CLips  on the  Yahoo site  under the User name " Eagle_averro_isme Photo album"   Nice seeing  you  great effort  in the " Picture speaks a THOUSAND words"  keep it  up and many thanks  to you and the teams.

posted by Eagle_Averro

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632636244060000000 Thu, 29 Sep 2005 21:00:06 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632636244060000000 Eagle_Averro Re: Rob Franco and team - IE 7 Security

posted by KenQ

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632644892170000000 Sun, 09 Oct 2005 21:13:37 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632644892170000000 KenQ Re: Rob Franco and team - IE 7 Security
KenQ wrote:
I would like to know if the final version of IE7 will have the toolbars locked or not. As in not giving the end user any way to move around the address toolbar or the buttons where you want them.

In Windows, the Explorer windows (aka shell windows), the navigation bar (back, forward, address / breadcrumb bar / search) is fixed at the top.   IE will do the same, for consistency with the shell as well as anti-spoofing.

For IE7 on XPSP2, we're considering our options.  In Beta 1, we've heard a lot of feedback from people who want the ability to move the toolbars around, including the menus and the navigation bar.   So no "final answer" on this issue yet.

posted by BruceMorgan

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632655524390000000 Sat, 22 Oct 2005 04:33:59 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632655524390000000 BruceMorgan Re: Rob Franco and team - IE 7 Security
BruceMorgan wrote:
In Windows, the Explorer windows (aka shell windows), the navigation bar (back, forward, address / breadcrumb bar / search) is fixed at the top.   IE will do the same, for consistency with the shell as well as anti-spoofing.


Doesn't toolbar customization make it harder to spoof the chrome?

I know when I'm surfing on a Mac, and a spoofed Windows dialog pops up, I get a good laugh. Smiley

posted by Maurits

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632655873890000000 Sat, 22 Oct 2005 14:16:29 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632655873890000000 Maurits Re: Rob Franco and team - IE 7 Security
Neelay

posted by neelayshah

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632680199370000000 Sat, 19 Nov 2005 17:58:57 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632680199370000000 neelayshah Re: Rob Franco and team - IE 7 Security posted by JoshuaAllen

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632693477090000000 Mon, 05 Dec 2005 02:48:29 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632693477090000000 JoshuaAllen Re: Rob Franco and team - IE 7 Security Great video. Learnt a lot of where you guys are going. I have to say that I expect to see many privilege escalation exploits next....better priv escalation exploits than remote exploits that run under admin privs automatically....

...in the video you were referring to sending in exploits and vulnerabilities, so you guys can verify the threat model of IE. Is the threat model of IE published somewhere? I think if it is would give the security research community a more direct way to probe it for weaknesses...

Thanks -
Christian

-----

http://www.mcs.vuw.ac.nz/~cseifert/blog/index.php

posted by cseifert

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632895927930000000 Thu, 27 Jul 2006 10:26:33 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c632895927930000000 cseifert Re: Rob Franco and team - IE 7 Security
The CDCer wrote:
It's great that you guys are working hard on security issues, but it's equally important to fix IE bugs. The z-index bug is a well know CSS bug since IE 4 or 5 nearly a decade ago with no easy cross-platform workaround, and it looks that the IE 7 team are still not aware of the problem. Please read <a href='http://cdcer.com/?2005/09/brutal-solution-to-ie-z-index-bug.html'>A brutal solution to the IE z-index bug</a> for more details and try to fix it. the world can't afford to fight with the bug for another 10 years!


Tell me about it.  IE7 is in the wild, and I'm still having to workaround 10 year old z-index bugs.  Every other browser seems to work with CSS.

posted by antichris

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c633114662680000000 Fri, 06 Apr 2007 14:24:28 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c633114662680000000 antichris Re: Rob Franco and team - IE 7 Security

You guys always deliver useful content. Awesome post. Very interesting and valuable videos. Keep posting more articles. Thanks for sharing useful info.

You guys always deliver useful content. Awesome post. Very interesting and valuable videos. Keep posting more articles. Thanks for sharing useful info.

posted by phentermine 37.

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c634178890640000000 Fri, 20 Aug 2010 08:17:44 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c634178890640000000 phentermine 37. Re: Rob Franco and team - IE 7 Security

You guys always deliver useful content. Awesome post. Very interesting and valuable videos. Keep posting more articles. Thanks for sharing useful info.

posted by phentermine 37.

]]> http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c634178892770000000 Fri, 20 Aug 2010 08:21:17 GMT http://channel9.msdn.com/Blogs/scobleizer/Rob-Franco-and-team-IE-7-Security#c634178892770000000 phentermine 37.