Hack InPrivate Browsing: Discover your Kids & Partners up to..

Do you think your girlfriend/boyfriend is cheating on you? Are your children visiting webs and you don't know anything about?
Many features we find in modern software are very useful, but sometimes, is complicated to know what they actually do.
InPrivate Browsing is of this kind. The name itself drives to confusion. If you haven't read about it, you might think is a sort of protection over your privacy on Internet.
To complicate the things a bit, the browser even comes with two new modes with similar names, InPrivate Browsing and InPrivate Filtering.
This is what Microsoft tell us about InPrivate Browsing:

"InPrivate Browsing in Internet Explorer 8 helps prevent your browsing history, temporary Internet files, form data, cookies, and usernames and passwords from being retained by the browser, leaving no evidence of your browsing or search history."

The key point is no leaving traces so there is no possibility someone discover what you are browsing. It seems like the ideal mode to use in a shared PC.
As we can see  it doesn't enhance your personal security but at least prevents others to obtain your browsing history from the computer.
I am going to test if it really does what it claims.
First we are going to erase any evidence, on Internet Explorer go to Tools tab:

Select Delete…, a list of check boxes will appear:

These way the browser history disappears. Just pressing Ctrl + H to see it:

Okay, now I am going to use two programs to try to look for traces.
Systance Index.dat Analyzer
Piriform Recuva
As you may notice these programs are free. We are now to navigate using InPrivate mode for a web to see if we can find traces. I have chosen BBC site, but it really doesn't matter.

Here we see how the history browsing looks:

Google appears because is the Home Page but there is no traces of bbc.co.uk at least here.

Using Recuva to find deleted files

Recuva is an awesome tool to find erased files. So, if Internet Explorer has tried to erase his traces just deleting the files we are going to find it.
Before using this software we need to prepare the operating system to show us every file that is in the computer. For this we go to the Control Panel, Appearance and Personalization and select Folder Options. Once you are there select the view tab, check Show hidden files, folder, and drives and uncheck Hide protecting operating system files.
Temporary internet files are stored in a system folder so we need to show these sort of files.
Recuva starts a Wizard when you first open it. We select to look for other files so it will look for all kind of files. You have to select where to find for the files. Temporary files are stored for Windows XP:
%USERPROFILE%\Local Settings\Temporary Internet Files
For Windows Vista, 7:
%userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files
If you find this complex you can select the "I'm not sure" option and the software will look everywhere.
The next windows ask if you want to select Deep Scan, you have to check it. This way there are more chances that you find what we are looking for.

Once it's completed, you have to order the files by date:

Indeed, as you can see is easy to know that someone has been at bbc.co.uk, and you can recover every file that was deleted from the temporary folder.
Maybe, you think that this is not important but it is not complicated to delete those files without leaving traces but Internet Explorer have chosen the generic and more easy way.

Using Index.dat analyzer

Index.dat are files used by Internet Explorer to store information about your browsing objects.
What exactly does this mean?
Index.dat is the method that Internet Explorer uses to control temporary internet files. This way knows if a file is from one web page or another. This file works as a database that informs the program when a web was accessed and every file that was part of that site.
The history also is saved in a index.dat file.
First time you run the program it will look for every index.dat in your system.
If you delete the Browsing History, as we did at the beginning of this article, the information of these files are erased.
But what happens after our test?, remember that Internet Explorer only shows that someone has visited Google.com.
If we select the following file:
%userprofile%\AppData\Local\Microsoft\Windows\Low\Temporary Internet Files\Content.IE5\index.dat

This appears because I typed bbc.co.uk and not www.bbc.co.uk, this is important because if the web page use this sort of links more traces appears. Looks what happens with cnn.com:

I have even found more traces on other file:
%userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

I get this last trace because Internet Explorer delete this in a very slow way. It finally gets deleted, but in one case it takes more than a minute to do it.
So InPrivate is not so private after all and you can easy know what have browsed.

Waiting for IE9 ? Join the test Drive

Interested in checking out the new Web platform capabilities of Internet Explorer 9? ‘Test Drive’ IE9 now!

Internet Explorer 9 (IE9) Platform Preview is now available for download.

The Platform Preview is an early look at the Internet Explorer 9 platform so some features are incomplete, some may change, and some may be added.

Visit Test Drive Internet Explorer 9 website.
If you wish to give feedback, please see this thread.
You can download an address bar for it from here.
Additional Reads:

IE Blog
Frequently Asked Questions.

MICROSOFT has released a patch for an Internet Explorer software hole through which China-based cyber spies attacked Google and other firms

"Microsoft continues to see limited and targeted attacks against Internet Explorer 6 only," said Jerry Bryant, senior security program manager at Microsoft.

"Microsoft recommends customers deploy this security update as soon as possible to protect themselves against the known attacks," he said.

Microsoft deemed the software fix so important that it veered from its usual protocol of releasing security updates the second Tuesday of each month. It urged Windows users to switch on Automatic Updates to receive the patch instantly.

It also refuted the advice of government experts to switch browsers.

"It is important to note that all software has vulnerabilities and switching browsers in an attempt to protect against this one, highly publicised, but currently limited attack can inadvertently create some false sense of security," Microsoft said.

Mr Bryant and  Microsoft security guru Adrian Stone hosted a public webcast this morning to discuss the security update and field questions.

They said the threat had been "responsibly reported" before the Google attacks, and was escalated after Google and other companies were targeted.

"There's a lot confusion out there," Mr Stone said.

"While there are a lot of circumstances around this software update... there is nothing technically different (with this threat) than other vulnerabilities of this type."

Describing a common threat known as a "drive-by update" - where unsuspecting victims click on a malicious link -  Mr Stone said this threat was similar.

"This is the same type of methodology... in terms of the vulnerability itself and the update itself, really it's par for the course."

He added that the fact that the vulnerability was being actively exploited was cause for concern.

Patching hacks

Microsoft warned that anti-virus software "will not protect you from the vulnerability", adding that it might detect malware that gets into your system without detecting or fixing the security hole.

Attacks that prompted a showdown between internet giant Google and global power China only worked against IE 6, so computer users can protect themselves by switching to newer versions of the web browser, according to Microsoft.

No matter which web browser people use, upgrading to the most current version promises to increase protection against hackers.

Microsoft confirmed last week that a previously unknown security vulnerability in its IE 6 browser was used in cyberattacks that prompted Google to threaten to shut down its operations in China on January 12.

Web security firm McAfee said that the attacks on Google and other companies showed a level of sophistication beyond that of cyber criminals and more typical of a nation-state.

Google said more than 20 other unidentified firms were targeted in the "highly sophisticated" attacks while other reports have put the number of companies attacked at more than 30. Only one other company, Adobe, has come forward so far and acknowledged that it was a target.

Attackers used email or some other lure to get employees of a targeted company to click on a link and visit a specially crafted website using Internet Explorer.

Malicious software would then be downloaded that has the capability to essentially install 'back doors' in machines and give hackers access.

Users can install the Internet Explorer fix either by switching on automatic security updates in Windows, or going to http://www.microsoft.com/technet/security/Bulletin/MS10-002.mspx
- with AFP

Vulnerability in Internet Explorer Could Allow Remote Code Execution. Warning: Do NOT use Internet Explorer until it is fixed.

Internet Explorer is proven very fragile and not secure finally Microsoft admit it all version of the IE is affected. Internet Explorer just cannot catch a break these days. The German Federal Office for Security in Information Technology has officially advised people to stop using Internet Explorer, all versions, until Microsoft releases a new patch for the latest gaping security hole. we advice you the same use other browser not the IE. 
    
Microsoft is investigating reports of limited, targeted attacks against customers of Internet Explorer 6, using a vulnerability in Internet Explorer. This advisory contains information about which versions of Internet Explorer are vulnerable as well as workarounds and mitigations for this issue.

MS investigation so far has shown that Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 is not affected, and that Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are vulnerable.

The vulnerability exists as an invalid pointer reference within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.
At this time, we are aware of limited, targeted attacks attempting to use this vulnerability against Internet Explorer 6. We have not seen attacks against other versions of Internet Explorer. We will continue to monitor the threat environment and update this advisory if the situation changes. On completion of this investigation, Microsoft will take appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) and our Microsoft Security Response Alliance (MSRA) programs to provide information that they can use to provide broader protections to customers. In addition, we’re actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.

Microsoft continues to encourage customers to follow the "Protect Your Computer" guidance of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software. Additional information can be found at Security at home.


Mitigating Factors: 

•	Data Execution Protection (DEP) is enabled by default in Internet Explorer 8 on the following Windows operating systems: Windows XP Service Pack 3, Windows Vista Service Pack 1, Windows Vista Service Pack 2, and Windows 7.
•	Protected Mode in Internet Explorer on Windows Vista and later Windows operating systems limits the impact of the vulnerability.
•	In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.
•	An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
•	By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone.
•	By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the user could still be vulnerable to exploitation of this vulnerability through the Web-based attack scenario.

If you were not aware, in Internet Explorer there is a current security problem that allows a webpage to maliciously inject code onto the machine running the browser. This bug was used by “Operation Aurora,” which hacked Google and other companies in recent days.

Consider this…if it is a large enough problem to hack Google, your site is not safe.

In a statement, the BSI (German Federal Office for Information Security) recommends that until a full patch is released for this “zero day” flaw, that Internet Explorer is not safe, even if users run IE in protected mode.
Given that the majority of the world still runs on Internet Explorer, it seems unlikely that any major impact will be made to IE market share, but at least in Germany the powers that be are making direct moves to protect their citizens.

Affected and Non-Affected Software

This advisory discusses the following software.

Affected Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4
Internet Explorer 6 for Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2
Internet Explorer 6 for Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for Itanium-based Systems, and Windows Server 2003 x64 Edition Service Pack 2
Internet Explorer 7 for Windows XP Service Pack 2 and Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2
Internet Explorer 7 for Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for Itanium-based Systems, and Windows Server 2003 x64 Edition Service Pack 2
Internet Explorer 7 in Windows Vista, Windows Vista Service Pack 1, Windows Vista Service Pack 2, Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Internet Explorer 7 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Internet Explorer 7 in Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Internet Explorer 7 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Internet Explorer 8 for Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2
Internet Explorer 8 for Windows Server 2003 Service Pack 2, and Windows Server 2003 x64 Edition Service Pack 2
Internet Explorer 8 in Windows Vista, Windows Vista Service Pack 1, Windows Vista Service Pack 2, Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Internet Explorer 8 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Internet Explorer 8 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Internet Explorer 8 in Windows 7 for 32-bit Systems
Internet Explorer 8 in Windows 7 for x64-based Systems
Internet Explorer 8 in Windows Server 2008 R2 for x64-based Systems
Internet Explorer 8 in Windows Server 2008 R2 for Itanium-based Systems Almost every release affected by it :(
Non-Affected Software
Internet Explorer 5.01 Service Pack 4 for Microsoft Windows 2000 Service Pack 4 <---<< Ha ha ha ha ha Poor Microsoft! In practice, no one use this may be billgets use that   At least Germany is doing something about it.  What we are doing ? when international time server is not even know even our local time like Google, Apple and others counting our time as GMT+7 & NO DTS