Race on between hackers, Microsoft over IE zero-day

Computerworld - Hackers are racing to build reliable exploits to use against a zero-day vulnerability in Internet Explorer (IE), putting pressure on Microsoft to push out a patch before attacks go public, researchers said today.

Yesterday, Microsoft first confirmed that new exploit code could compromise PCs running Internet Explorer 6 (IE6) and Internet Explorer 7 (IE7), then later in the day issued a security advisory that said Windows 2000, Windows XP and Windows Vista users were at risk.

Because the attack code had been publicly posted to a widely-read mailing list, researchers today said that the clock has started.

"This is clearly a critical vulnerability, and as bad as it gets," said Ben Greenbaum, a senior research manager with Symantec's security response team. "It is a race, yes, it certainly is," he added when asked whether hackers and Microsoft are pitted in a drag race.

"Definitely some kind of race," agreed Wolfgang Kandek, the chief technology officer at security company Qualys. "It's a matter of whether Microsoft can fix it first or attackers can get something that works reliably."

According to Kandek, variants of the original attack code have appeared on the Web. "So attackers are already working on [more reliable versions]," he said.

Greenbaum echoed Kandek's take that the original exploit was iffy. "By our tests, the published exploit code only works some of the time against some of the platforms," said Greenbaum. "[Hackers] will have to work on developing a more reliable exploit."

Their job won't be easy, but it can be done without too much difficulty, said Greenbaum, who characterized the creation of a working attack as somewhere between those two poles. "It won't be trivial, but it's not the Holy Grail of computing, either," he said.

In , Microsoft offered up several ways that users could protect their PCs until a patch is available, ranging from turning on the DEP (data execution prevention) security feature in IE6 and IE7, to boosting the browsers' security settings -- something that would block JavaScript. That move had been urged on users by several security companies Monday as a way to stymie any attack based on the original exploit, which relied on JavaScript to hijack a Windows PC.

Read more about security in Computerworld's Security Knowledge Center.