Posted by Andy Dingley on 09/12/06 13:33

TC wrote:



> This is the poorly known and generally misunderstood "Mark Of The Web",
> or MOTW. It adjusts the operation of the "Local Machine Lockdown"
> feature that was added in Windows XP SP2.

Hang on - have I got this right?

Suppose I'm an 3v1l h4xx0r d00d, out to perform evil upon your IE
browser. I manage to deploy my nasty payload to your machine, but IE
saves you because the local filesystem is now seen as untrustworthy
(I'll let the stupidity of this approach pass for a moment).

Now I'm thwarted and my evil doings are as naught. But if I add the
mystical incantation <!-- saved from url=(0014)about:internet --> to my
payload files, they'll start being powerfully evil again ?

Excuse me if I'm somewhat underwhelmed by this particular bit of
Security Theatre....

[Back to original message]