this exploit has been around for a while now... didn't apple release a fix with the last QT update?

i love how you can receive detailed instructions on how to set up this exploit by just simply going to a security website...

Don't be an idiot, the public has a right to know about security flaws. You can not punish legit people becuase of tools.

l2pnoob

From the article:

Quote

you first need to have a MySpace User Profile of your own. If you are logged into MySpace and view a maliciously crafted QuickTime file on someone else's MySpace page, JavaScript code can be added to your MySpace page that makes changes to your user profile.

Is this the only way to be unknowingly redirected to an alternate Web page?

Quote

Avoid playing QuickTime movies and audio files on MySpace profile pages

In other words, this wouldn't happen if I view the maliciously crafted QuickTime file while not logged in to MySpace, or if I wasn't a member of MySpace to begin with.

Quote

Disabling QuickTime's auto-play feature is a good idea

If I have a website with QuickTime movies in it - and people disable this feature - will they still be able to view my movie?

Wasn't there "Play movies automatically" exploit back in the Mac OS 7/8/9 days?

I seem to vaguely remember something and the work around was to make sure that wasn't checked.

Anybody remember that exploit?

Quote

felixgardian wrote:
Don't be an idiot, the public has a right to know about security flaws. You can not punish legit people becuase of tools.

Yeah I know, right? Those poor innocent security companies are just trying to make the World a better place. They certainly would never do anything (such as provide detailed instructions) that would cause such exploits to further spread. Such things would definitely not be in their best interests. They are only looking out for us, the common people.

Like if a scientist found some new deadly poison that was easy to make and was undetectable, he should take out a full page ad out in the New York Times telling everyone how to make it. The public has a right to know! Guns don't kill people. They are just a tool.

So you would rather live in danger with your ignorance?

Quote

Biff wrote:

Quote

felixgardian wrote:
Don't be an idiot, the public has a right to know about security flaws. You can not punish legit people becuase of tools.

Yeah I know, right? Those poor innocent security companies are just trying to make the World a better place. They certainly would never do anything (such as provide detailed instructions) that would cause such exploits to further spread. Such things would definitely not be in their best interests. They are only looking out for us, the common people.

Like if a scientist found some new deadly poison that was easy to make and was undetectable, he should take out a full page ad out in the New York Times telling everyone how to make it. The public has a right to know! Guns don't kill people. They are just a tool.

on this site are regurgitated right from macfixit

To the comment below: No I wouldn't, but that still doesn't mean the details have to be made so explicit that others can set up more exploits.

Quote

felixgardian wrote:
So you would rather live in danger with your ignorance?

Quote

Biff wrote:

Quote

felixgardian wrote:
Don't be an idiot, the public has a right to know about security flaws. You can not punish legit people becuase of tools.

Yeah I know, right? Those poor innocent security companies are just trying to make the World a better place. They certainly would never do anything (such as provide detailed instructions) that would cause such exploits to further spread. Such things would definitely not be in their best interests. They are only looking out for us, the common people.

Like if a scientist found some new deadly poison that was easy to make and was undetectable, he should take out a full page ad out in the New York Times telling everyone how to make it. The public has a right to know! Guns don't kill people. They are just a tool.

Quote

Anonymous wrote:
on this site are regurgitated right from macfixit

Guest -

When we write articles that use information from other sources, whether that's the Wall Street Journal, New York Times, or macfixit.com, we always attribute the source. This article includes my own research, but if macfixit.com had information that I felt I needed to add, you can rest assured I would cite them accordingly.

The last time I recall regurgitating anything, I had a nasty case of the flu.

Jeff

I'm sure that all the script kiddies will get right on that one, like the huge gamut of problems the Mac has right now with security flaws being detailed publicly...

Quote

Guest wrote:
To the comment below: No I wouldn't, but that still doesn't mean the details have to be made so explicit that others can set up more exploits.

Quote

felixgardian wrote:
So you would rather live in danger with your ignorance?

Quote

felixgardian wrote:
I'm sure that all the script kiddies will get right on that one, like the huge gamut of problems the Mac has right now with security flaws being detailed publicly...

Can you honestly say that making certain exploit details more explicit won't entice more nefarious actions by "script kiddies" or other unscrupulous parties?

You seem to be ignoring that there might be an increasing negative tendency towards a lack of discretion in security-related information being publicly disseminated, which is one of the points made in this article:

http://alastairs-place.net/2006/11/dmg-vulnerability/

Just because you or I may have the ability to understand and handle these issues in proper context doesn't mean everyone does.

Wrong.

Quote

Guest wrote:

Quote

felixgardian wrote:
I'm sure that all the script kiddies will get right on that one, like the huge gamut of problems the Mac has right now with security flaws being detailed publicly...

Can you honestly say that making certain exploit details more explicit won't entice more nefarious actions by "script kiddies" or other unscrupulous parties?

You seem to be ignoring that there might be an increasing negative tendency towards a lack of discretion in security-related information being publicly disseminated, which is one of the points made in this article:

http://alastairs-place.net/2006/11/dmg-vulnerability/

Just because you or I may have the ability to understand and handle these issues in proper context doesn't mean everyone does.

Quote

felixgardian wrote:
Wrong.

And how does that enlighten the discussion?

Because it points out your lack of understanding.

GG

Quote

Anonymous wrote:

Quote

felixgardian wrote:
Wrong.

And how does that enlighten the discussion?

Quote

felixgardian wrote:
Because it points out your lack of understanding.

Care to be more specific, preferably without the condescending smugness? I thought my opinion was expressed clearly and sincerely, yet you've disagreed by responding with nothing more than "wrong" and accusing me of lack of understanding. Maybe I've misread your intention behind those glib remarks but they seemed disrespectfully distasteful to me. I'd hoped for a bit more civil, interactive discussion even if there's disagreement.

I suspect it is a reference to the historical lack of urgency in fixing security issues exhibited by software companies (Apple included... ping of death, anyone?). This can be due to internal infighting, or simple ostriching. While notifying the affected company first is good practice, putting them on notice that you will publicise the flaw after a set period of time tends to concentrate minds.

In any case, the moment any fix is released, the "Bad Guys" will be able to reverse-engineer it, and use that knowledge to attack unpatched systems.