Microsoft confirms IE zero-day behind Google attack
Bets are on that Microsoft will rush patch to deflect public relations nightmare
Computerworld - Microsoft issued a security advisory today that warned users of a critical and unpatched vulnerability in Internet Explorer (IE), and acknowledged that it had been used to hack several companies' networks.
"We have determined that Internet Explorer was one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks," said Mike Reavey, director of Microsoft's Security Response Center (MSRC), in a post to the group's blog.
Earlier today, antivirus company McAfee said the IE bug had been exploited by hackers who had attacked computer networks of nearly three dozen major companies between mid-December 2009 and Jan. 4, 2010. McAfee said then that Microsoft would soon release this advisory.
The security advisory said that the only version of IE not containing the critical flaw was IE 5.01 running on Windows 2000. All other versions, including IE6, IE7 and IE8 on Windows 2000, XP, Server 2003, Vista, Server 2008, Windows 7 and Server 2008 R2 are vulnerable to attack.
Even so, Reavey downplayed the threat to average Windows users. "Microsoft has not seen widespread customer impact, rather only targeted and limited attacks exploiting IE6 at this time," he said.
"An IE zero-day in all versions," said Andrew Storms, director of security operations at nCircle Network Security, "so by no means is this good for Microsoft. The only encouraging news is that there are tools that protect Vista and Windows 7 on IE7 and newer, so that an exploit would crash [those browsers] rather than allow code execution." Storms was referring to security provisions within IE, including DEP (data execution prevention) and Protected Mode, on newer versions of Windows.
Microsoft's Reavey hammered that home as well. "Protected Mode in IE 7 on Windows Vista and later significantly reduces the ability of an attacker to impact data on a user's machine," Reavey said. "Customers should also enable Data Execution Prevention, which helps mitigate online attacks."
Although DEP is on by default in IE8, it must be manually switched on in IE6 and IE7. Users can enable DEP by using the "Fix it" tool Microsoft has posted on its support site.
As McAfee noted earlier today, an IE user's PC could be hijacked simply by steering the browser to a malicious site, or to a compromised legitimate site that hosted attack code.
Microsoft said users could also protect themselves to some degree by setting the PC's Internet zone's security to the "High" option, but warned that it wasn't surefire. "It is important to note that the vulnerable code may be reached even with these protections in place," the company said in the advisory. "However, any attacks would be less successful with these workarounds in place."
Web giants attacked
- White House orders security review in wake of WikiLeaks disclosure
- Leaked U.S. document links China to Google attack
- Update: Researchers track cyber-espionage ring to China
- Google, China now playing cat and mouse?
- McAfee: 'Amateur' malware not used in Google attacks
- Military warns of 'increasingly active' cyber-threat from China
- China: Google 'totally wrong' to stop censoring
- Update: Google stops censoring in China
- Google's China ad partners wait in 'incomparable pain'
- Google may soon leave China, reports say
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- 3 Steps to Content Sharing and Collaboration ft. Forrester Research Consumer sync and share tools help people access and send personal files, but smart IT leaders know that businesses require more than just...
- Empowering Your Mobile Workers A modern mobile IT strategy is no longer an option, it is an absolute necessity. Here's how some of the nation's most progressive...
- Info-Tech Research Group Vendor Landscape: Cloud File Sharing Box recommends this report for any growing business or company considering an investment in enterprise content collaboration and cloud file sharing.
- Four Myths of High-Productivity App Dev Debunked Debunk the main myths surrounding high-productivity application development and how both platforms have overcome them.
On-Demand Webcast: 7 Reasons to Choose VoIP
Thinking about a new phone system for your business?
Be sure to watch this informative webcast. Steve Strauss, small business columnist for USA...
All Cybercrime and Hacking White Papers |