Protect IE6 from exploits when testing? - security

I wrote an app in C# which uses the webbrowser control. While using it, the site i happen to use it on had an ad that auto DLed and ran itself on my comp causing me to be very annoyed. According to safebrowsing.clients.google.com 2/5000 pages had this exploit, unlucky me.
I use IE6 for testing so what can i do to protect myself from those virus w/o upgrading to IE7+. Will setting the internet security to high solve the problem? (It appears to set every option to disable)

Use the VPC images that MSFT provides so if you get pwn3d, you can just blow away the image and start over.

Related

Getting CSP reports on www.pagespeed-mod.com

I have switched to using Content-Security-Policy for my website. I'm starting to see reports about the following not being allowed: https://www.pagespeed-mod.com/v1/taas
Does anyone know why the website is trying to load this file? I'm using Google Analytics and Tag Manager, but I don't think that I have any page speed mod installed. Maybe this is an extension in the user's browser? Or when they open developer tools? Another source I could think of is automatic optimization through Cloudflare which I'm also running on.
Extra info: The source of loading this script is https://3001.scriptcdn.net/code/static/1 which doesn't reveal much about who made that.
Had the exactly the same issue and preventing me from using Element Inspector/ debugger. It appears to be some Chrome extension you have installed gone rogue, see if you have extension called "Auto Refresh Plus" installed like i did before.
I also see reports on https://www.pagespeed-mod.com/v1/taas being blocked with the same source of loading. It seems to happen in short periods on the various resources I have reports from. This indicates that it is related to the user/browser and not related to the site itself.
The same can be seen with translators, extensions, security proxies etc. I have given up trying to attribute the source of anything that is likely not caused by legitimate site content.

Relatve URL in distant file (XLS)

I have a problem at my job.
I am totally dependent on a website which must certainly date from the eighties ...
In one of the web pages, there is a link to download an excel file (xls). Let's say for example http://example.excel.xls
In this file, there are hyperlinks to other files (sometimes i think the death penalty is a good thing! ^^).
These links are relative :'( (for example \myfile.pdf)
Internet explorer, strangely, are correcting these links by transforming them in absolute path (http://example.myfile.pdf)
Other browsers (chrome, firefox, even the old edge) don't do it natively. By clicking on the link, we arrive in the local cache, where of course there arenot my files ...
I will soon have to remove IE from computers.
I had considered sending a bombshell on the administrators of this website, but afraid of legal repercussions :)
Is it possible, via settings, an addon or whatever, to make one of the browsers behave in the same way as IE?
I am very grateful for the help you will give me
You had asked,"Is it possible, via settings, an addon or whatever, to make one of the browsers behave in the same way as IE?"
I suggest you make a test with the MS Edge (Chromium) browser.
The MS Edge (Chromium) browser comes with the IE mode feature.
IE mode on Microsoft Edge makes it easy to use all of the sites your organization needs in a single browser. It uses the integrated Chromium engine for modern sites, and it uses the Trident MSHTML engine from Internet Explorer 11 (IE11) for legacy sites.
To configure IE mode, I suggest you refer to Configure IE mode policies. You can refer to the document and configure the necessary policies to enable the IE mode.
It can help you to load your legacy site in the Edge browser using the IE mode which can help you to fix the said issue.

Azure pricing calculator not updating estimates

I am trying to price out various azure services and when I add them to the calculator and make changes the estimate does not update.
I have tried this in Edge, IE, Chrome, Firefox (normal browsing and Private) and I get the same results.
I also ran CCleaner and removed all of the files for each browser.
The calculator did work a few days ago.
Any ideas?
I had the same problem. A solution that works for me is to open a new InPrivate window from the Edge browser. (A new private window from Firefox did not solve the problem).
Perhaps the problem is related to cookies? I have not tested after deleting all cookies. #jake, when you used CCleaner, was it set to delete cookies or just cached data and files?
(For what it is worth, in the Firefox developer console I see several warnings related to failed loading of JS scripts. I can't say if such a failure is the cause of the problem, but it looks like Microsoft needs to do better testing of the calculator page.)

Loadrunner and security issues

Accessing an application manually works fine, creating a manual script with web_add_header works fine, but when just hitting record in vugen with the http protocol the webpage gets "page cannot be displayed".
What can cause this? I assume it has something to do with security?
Can I change some settings in vugen to make this work?
I don't know that this will solve your problem, but I have seen somewhat similar behavior when dealing with security certificates on SSL enable pages. Try installing or re-installing the security certificate for the site in IE before you try recording the script.
Take a look at your credentials in the system and your browser vendor/version. Make sure that you have admin rights and that you are using a 32 bit browser (VUGEN is a 32 bit application) is one supported for your version of LoadRunner

Good reasons for not letting the browser launch local applications

I know this might be a no-brainer, but please read on.
I also know it's generally not considered a good idea, maybe the worst, to let a browser run and interact with local apps, even in an intranet context.
We use Citrix for home-office, and people really like it. Now, they would like the same kind of environment at work, a nice page where every important application/document/folder is nicely arranged and classified in an orderly fashion. These folks are not particularly tech savvy; I don't even consider thinking that they could understand the difference between remote delivered applications and local ones.
So, I've been asked if it's possible. Of course, it is, with IE's good ol' ActiveX controls. And I even made a working prototype (that's where it hurts).
But now, I doubt. Isn't it madness to allow such 'dangerous' ActiveX controls, even in the 'local intranet' zone? People will use the same browser to surf the web, can I fully trust IE? Isn't there a risk that Microsoft would just disable those controls in future updates/versions? What if a website, or any kind of malware, just put another site on the trust list? With that extent of control, you could as well uninstall every protection and just run amok 'till you got hanged by the IT dept.
I'm about to confront my superiors with the fact that, even if they saw it is doable, it would be a very bad thing. So I'm desperately in need of good and strong arguments, because "let's don't" won't do it.
Of course, if there is nothing to be scared of, that'll be nice too. But I strongly doubt that.
We use Citrix for home-office, and people really like it. Now, they would like the same kind of environment at work, a nice page where every important application/document/folder is nicely arranged and classified in an orderly fashion
I haven't used Citrix very many times, but what's it got to do with executing local applications? I don't see how "People like Citrix" and "browser executing local applications" relate at all?
If the people are accessing your Citrix server from home, and want the same experience in the office, then buy a cheap PC, and run the exact same Citrix software they run on their home computers. Put this computer in the corner and tell them to go use it. They'll be overjoyed.
Isn't it madness to allow such 'dangerous' ActiveX controls, even in the 'local intranet' zone ? People will use the same browser to surf the web, can I fully trust IE ?
Put it this way. IE has built-in support for AX controls. It uses it's security mechanisms to prevent them from running unless in a trusted site. By default, no sites are trusted at all.
If you use IE at all then you're putting yourself at the mercy of these security mechanisms. Whether or not you tell it to trust the local intranet is beside the point, and isn't going to affect the operation of any other zones.
The good old security holes that require you to reboot your computer every few weeks when MS issues a patch will continue to exist and cause problems, regardless of whether you allow ActiveX in your local intranet.
Isn't there a risk that Microsoft would just disable those controls in future updates / versions ?
Since XP-SP2, Microsoft has been making it increasingly difficult to use ActiveX controls. I don't know how many scary looking warning messages and "This might destroy your computer" dialogs you have to click through these days to get them to run, but it's quite a few. This will only get worse over time.
Microsoft is walking a fine line. On one hand, they regularly send ActiveX killbits with Windows Update to remove/disable applications that have been misbehaving. On the other hand, the latest version of Sharepoint 2007 (can't speak for earlier versions) allows for Office documents to be opened by clicking a link in the browser, and edited in the local application. When the edit is finished, the changes are transmitted back to the server and the webpage (generally) is refreshed. This is only an IE thing, as Firefox will throw up an error message.
I can see the logic behind it, though. Until Microsoft gets all of their apps 'in the cloud', there are cases that need to bridge the gap between the old client-side apps and a more web-centric business environment. While there is likely a non-web workaround, more and more information workers have come to expect that a large portion of their work will be done in a browser. Anything that makes the integration with the desktop easier is not going to be opposed by anyone except the sysadmins.
The standard citrix homepage (or how we use it) is a simple web page with program icons. Click on it, and the application get's delivered to you. People want the same thing, at work, with their applications/folders/documents. And because I'm a web developer, and they asked me, I do it with a web page... Perhaps I should pass the whole thing over to the VB guy..
Ahh... I know of 2 ways to accomplish this:
You can embed internet explorer into an application, and hook into it and intercept certain kinds of URL's and so on
I saw this done a few years ago - a telephony application embedded internet explorer in itself, and loaded some specially formatted webpages.
In the webpage there was this:
Call John Smith
Normally this would be a broken URL, but when the user clicked on this link, the application containing the embedded IE got notified, and proceeded to execute it's own custom code to dial the number from the URL.
You could get your VB guy to write an application which basically just wraps IE, and has handlers for executing applications. You could then code normal webpages with links to just open applications, and the VB app would launch them. This allows you to write your own security stuff (like, only launch applications in a preset list, or so on) into the VB app, and because VB is launching them, not IE, none of the IE security issues will be involved.
The second way is with browser plug-ins.
For example, skype comes with a Firefox plug-in, which looks for phone-numbers in web-pages, and attaches special links to them. When you click on these links it invokes skype - you could conceivably do something similar for launching your citrix apps.
You'd then be tied to firefox though. Writing plugins for IE is much harder than for FF, I wouldn't go down that path unless forced to.

Resources