Microsoft fortifies IE8 against new XSS exploits
Engineers in Microsoft's Internet Explorer group continue to refine a new security feature designed to block malicious scripts that can be injected into trusted websites to steal email and account credentials. Judging from the magnitude of the problem, their task may never be completed.
Among the multitude of revisions introduced in last week's release of Internet Explorer 8 were tweaks intended to make the browser's cross-site scripting (XSS) filter better withstand tricks for concealing malicious characters in web addresses. Some of the world's foremost web application security experts helped, an indication of the difficulty of containing the threat.
One fix enables input to be treated as a stream of individual bytes rather than characters, a change that prevents attackers from evading the filter using Chinese characters in web addresses. Because of the way certain characters, including "<" are rendered in Chinese, bad guys were able to sneak them into malicious URLs that weren't detected by versions of the Microsoft beta browser.
:
