PivX Provides Free Fix For The Microsoft Internet Explorer Gopher Hole
Source: Internet Wire
Publication date: 2002-06-13
NEWPORT BEACH, CA — (INTERNET WIRE) — 06/13/2002 — PivX Solutions, the creator of the patented and proprietary network intrusion security system Inviswallâ„? announced today that they have created a FREE Patch/FIX for the latest Microsoft® Internet Explorerâ„? security hole- Gopher Root Vulnerability[1]:(online.securityfocus.com/news/464) or (online.securityfocus.com/bid/4930/info) “It would not take many minutes to put up a gopher server with a Win32’rootkit’ as content, and then put an innocent but interesting looking link into a web page (‘free live World Cup scores’ would do nicely right now). And, with a link pointing to that server, have a page auto-forward to a malice gopher link, and, viola! A few more suckers rooted. This would likely pass through most firewalls as well.” Simon Brooke, CTO Scaffie Ltd.
Gopher was first discovered on May 22 by Online Solutions of Finland. (www.solutions.fi) They did not release the exploit publicly, but instead sent the code directly to Microsoft so that hackers could not exploit it. They did the right thing by reporting the vulnerability directly to Microsoft rather than posting the exploit to the security community as some others have previously done. PivX just felt that getting a fix was important as well, so they created one.
PivX found the syntax for the exploit and was able to custom craft a fix. It is just a matter of time until hackers find the general method on exploiting gopher to gain root access on a multitude of systems. There is always a catastrophic possibility for cyber terrorism or wide scale damage with any security hole or vulnerability, but with this one in particular. The simplicity of this attack coupled with the widespread usage of Internet Explorerâ„? would enable an amateur ‘script kiddie’ launch a full scale attack with less effort than sending a single mass e-mail. This could effectively turn millions of workstations around the world into an army of unstoppable drone soldiers, obliterating any target that they acquire within milliseconds.
“Sure, this exploit only affects personal computers and small servers, but the power in all of the personal computers in the world clustered together is hundreds of thousands of times faster than any billion dollar government supercomputer. An even low-tech cracker that harnessed that would be unstoppable, and it is scary just how easy it would be to do so.” Said Sam Balooch, Former Director Worldwide Datacenters SGI, PacBell, Sun, Wingcast Mobility.
PivX initially released its first fix for this enormous hole on June 9th at midnight PST. After the first 15 hours we recorded over 75,000 downloads. Please visit the PivX Gopher-Smoker webpage for more information: www.pivx.com/gopher_smoker.html
About PivX Solutions
PivX Solutions, is a premier network security consultancy. It’s crack team of engineers and technical staff led by 19 year old network security prodigy and University of California cybercrime instructor Geoff Shively has discovered holes and flaws in some of the world’s best-known hardware and software manufacturers operating systems and hardware. PivX consults with some of the country’s largest and most highly sensitive companies, consultancies and organizations. Their network security product specialists developed the patented and proprietary Invisiwallâ„? network security device which offers the most comprehensive and secure intrusion detection system available.
For more information please go to: www.pivx.com or you can email us at: press@pivx.com
About Centrifuge Partners
Centrifuge Partners provides marketing-based critical thinking, strategic planning and an interim marketing department function to brands and capital partners nationally. Clients have included startups to Fortune 500 companies. The company is headquartered in Newport Beach, California, with partners and affiliates in Los Angeles, San Francisco, and New York. For more, visit www.centrifugepartners.com/clients.htm.