A secure democratic Net is a fundamental right

* the chinese securityresearchers that found the vulnerability released the code by mistake

* the exploits waits for 6 seconds after you visit the site to fool antivirus systems who seem to be looking only for code before and immediately after you visit a site

* it uses malencoded xml strings or code that are sent to the browser and makes it crash. This should remind some business developers that XML code can be used in a very effective way to attack systems and applications. If they look at xml bombs for example they will see why defense, control and certification are necessary for xml. It is just code, so it can be used in any way, good and bad.

* it is placed on other sites in an iframe. So if you have a forum or social site, you shouldn't allow users to insert html tags in any way. Otherwise you will find yourself one day with iframes that will launch these attacks on your visitors.

* it is NOT patched yet - but I suppose an emergency patch is in order

* it is also being used in Taiwan and China to install password stealers for games over there. http://www.steoo.com/admin/win.exe (do not click)

http://cyberwarfaremag.wordpress.com/2008/12/11/internet-...