Internet Explorer users under attack

[Richard]

Posted by Adrian Kingsley-Hughes @ 3:50 pm

A friendly note to all Internet Explorer users …

If you’re using IE (any version, ranging from 5.01 t0 8.0 beta 2) then you need to be aware of a new vulnerability which is set to become a big problem over the next few days.

I’m not going to rehash the details of this vulnerability other than to say that it’s pretty serious and has the scope to affect a massive number of users.

Here’s the scope of this vulnerability according to Microsoft:

Based on our stats, since the vulnerability has gone public, roughly 0.2% of users worldwide may have been exposed to websites containing exploits of this latest vulnerability. That percentage may seem low, however it still means that a significant number of users have been affected. The trend for now is going upwards: we saw an increase of over 50% in the number of reports today compared to yesterday.

For background and more information here are some links:

· Microsoft Security Advisory (961051)

· The new IE exploits for Advisory 961051, now hosted on pornography sites

· Clarification on the various workarounds from the recent IE advisory

The next official Patch Tuesday isn’t until January 9, 2009 but I’ve heard whispers that we’ll see a patch for this vulnerability out this side of the holidays.

Take care out there … especially if you’re still using IE!

http://blogs.zdnet.com/hardware/?p=3189

[Richard]

Microsoft releasing emergency patch for perilous IE flaw

by Glenn Chapman Glenn Chapman
Tue Dec 16, 5:49 pm ET
 
SAN FRANCISCO (AFP) – Microsoft will release an emergency patch on Wednesday to fix a perilous software flaw allowing hackers to hijack Internet Explorer browsers and take over computers.

The US software giant said on Tuesday that in response to "the threat to customers" it immediately mobilized security engineering teams worldwide to deliver a software cure "in the unprecedented time of eight days."

According to researchers at software security firm Trend Micro, attacks based on the vulnerability in the world's most popular Web browser are spreading "like wildfire" with millions of computers already compromised.

Microsoft typically releases patches for its software on the second Tuesday of each month and rushing this fix to computer users out-of-cycle is testimony to the severe danger of the threat, according to Trend Micro.

"When the patch is released people should run, not walk, to get it installed," said Trend Micro advanced threat researcher Paul Ferguson.

"This vulnerability is being actively exploited by cyber-criminals and getting worse every day."

Trend Micro has identified about 10,000 websites that have been infected with malicious software that can be surreptitiously slipped into visitors' unprotected IE browsers to take advantage of the flaw.

A major Internet portal in Taiwan is among the legitimate websites unknowingly tainted with malicious software aimed at IE's weak spot, according to Ferguson.

Hackers can take control of infected computers, steal data, redirect browsers to dubious websites, and use machines for devious activities such as attacks on other networks, according to security specialists.

"What makes this so insidious is it takes advantage of a big gaping hole of IE, which has the largest install base of any browser on the market," Ferguson said.

IE is used on nearly three-quarters of the world's computers, according to industry statistics from November.

"At this time, we are aware only of attacks that attempt to use this vulnerability against Windows Internet Explorer 7," said Microsoft security response communications head Christopher Budd.

"Microsoft encourages customers to test and deploy this update as soon as possible. Microsoft's teams worked around the clock."

Ferguson said the flaw is being taken advantage of in "multiple versions" of IE not just the most current.

Trend Micro urges IE users to heed precautionary advice from Microsoft, or avoid using the browsers, until the patches are applied.

"There is a working flaw circulating in the criminal underground," Ferguson said. "It opens the window of opportunity that much wider to take advantage and there has not been real protection against it."

The "exploit" is similar to one used recently to steal user names, passwords and other information from people playing online games in China, according to Trend Micro.

A Chinese computer security firm that had discovered attacks taking advantage of the IE flaw released details last week after evidently thinking Microsoft had fixed the problem with routinely released software patches.

"It spread like wildfire from there," Ferguson said. "I guess they were trying to be responsible and share what they knew about what was going on, but they were mistaken about it being patched."

http://news.yahoo.com/s/afp/20081216/ts_...usneEEtbAF