Old Papa Weaver, he was a strong man.
Snooping on the Results
We tried this, in the real world
We included a file that just calls GetUserName() and GetComputerName() and issues a GET to foofus.net (via WinInet.dll)
Properly configured browsers do not allow the initialization of Shell.Application
Up-to-date anti-virus will catch the file, once it is written to the disk
So, did we get any results?
The anti-virus didn't block things before they got executed, at least some of the time
It's not just out-of-date configurations that are vulnerable: can you guess who?
Once again: there is nothing very new here, and it's not a breakthrough technical achievement
Still, it's been difficult, in the past, to get any data whatsoever about whose browsers are vulnerable
Also, it underscores how very crucial administration and management of desktops can be
This page is maintained by Foofus. Please direct comments and questions to foofus <at> foofus.net.