From: "Glenn Meadows" 

Thanks, as I suspected, a simple "user have to do something" can
pretty easily be turned into an auto infect function.

Now, using my "worst case scenario" bad guy "could it ever
happen", how about coupling that into an html email, where it
infects/spreads a virus that way?  Think it's possible?  Someone will try,
I'll bet. .

--
Glenn M.


"Geo."  wrote in message
news:4128acd1$1{at}w3.nls.net...
> Glenn,
>
> You had asked what I thought about the malware exploit for IE (XPsp2) and
I
> said I thought it was lame because it required the user to drag and drop
stuff.
> Well I was wrong, read this new version description.
>
> Geo.
> ----------------------
>
> Most people i talked to consider the drag and drop vulnerability found by
> http-equiv not as a serious problem, because it requires some user
> interaction and the press pushes this topic way to much as the "first
> security problem in SP2". In an article on BetaNews even Microsoft claims
> it's not a high risk for customers
> (http://www.betanews.com/article/1093035994).
>
> To proof it's not a "hype" created by the media or companies
like secunia,
i
> created another proof-of-concept based on http-equiv's code that hides
both
> the image to drag and the local folder you drop it to. As a result using
the
> window scrollbar will install malware in your startup folder.
>
> A little 5x5 pixel "drop zone" will automaticly follow your
mouse. Just
drag
> the window scrollbar as usual (and a hidden image at the same moment) and
> whereever you release the mouse button you will drop an exe file to your
> shell:startup (as long as you remain inside the browser window of course).
>
> Demo website: http://www.mikx.de/scrollbar/
>
> Dragging the window scrollbar is a common behavior - even if i can't
believe
> there was a world before mouse wheels. A common user will probably don't
> recognize the installation at all.
>
> Speaking of behaviors: If service pack 2 is installed you can work around
> this vulnerability by disabling "binary behaviors" in the
new IE activex
> settings. You don't need to disable scripting completely.
>
> It took me only 20 minutes to create this, so script kids around the world
> with enough free time will create even better protected mechanisms to
> exploit this bug in the near future.
>
> Take it serious!
>
> mikx
>
>

--- BBBS/NT v4.01 Flag-5