Microsoft confirms hackers exploiting critical IE bug, promises patch
Suggests temporary defenses, but others urge users to switch to Chrome or Firefox
Computerworld - Microsoft on Monday issued a security advisory that confirmed in-the-wild attacks are exploiting an unpatched bug in Internet Explorer. The software maker is working on a fix.
The advisory addressed the "zero-day" vulnerability -- meaning it was discovered and exploited before a patch was available -- that was found and disclosed by researcher Eric Romang over the weekend. On Monday, the Metasploit open-source penetration framework published an exploit module for the bug, putting pressure on Microsoft to act quickly.
"We have received reports of only a small number of targeted attacks and are working to develop a security update to address this issue," said Yunsun Wee, director of Microsoft's Trustworthy Computing group, in a post to the Microsoft Security Response Center blog.
All but one supported edition of IE are affected: 2001's IE6, 2006's IE7, 2009's IE8 and last year's IE9. Together, those browsers accounted for 53% of all browsers used worldwide in August. The only exception was IE10, the browser bundled with the new Windows 8, which does not contain the bug.
Monday's advisory was expected, said Andrew Storms, director of security operations at nCircle Security. "I think they had to get it out today," said Storms late Monday in an interview over instant messaging. "Too many people watching and waiting for something official."
Earlier Monday, Microsoft acknowledged that it was investigating reports of a vulnerability but did not promise a patch.
The bug, when Microsoft gets around to patching it, will be rated "critical," the company's highest threat ranking. Exploiting the flaw allows hackers to execute code -- in other words, plant malware on a machine -- and opens Windows XP, Vista and Windows 7 to drive-by attacks that only require getting victims to visit a malicious or compromised website.
Until a patch is available, Microsoft recommended that users block attacks with EMET 3.0 (Enhanced Mitigation Experience Toolkit), boosting IE's security zone settings to "high," and configuring the browser to display a warning before executing scripts.
EMET is a tool designed for advanced users, primarily enterprise IT professionals, that manually enables anti-exploit technologies such as ASLR (address space layout randomization) and DEP (data execution prevention) for specific applications.
But not everyone agreed that EMET was the answer.
"[EMET] has its place, but I think most people would prefer the bug fix," said Storms. "EMET is one of those tools that takes time to deploy, [so] it's not a good idea to try and rush the deployment right now. It's kind of like a self-defeating process. Microsoft would like more people to use EMET, but given the few zero-days and relative quickness to patch things, the need for EMET seems to be reduced."
- Feds declare big win over Cryptolocker ransomware
- Hackers hit more businesses through remote access accounts
- P.F. Chang's post-breach move to manual processing is telling
- Microsoft withholds monster IE update from Windows 8.1 dawdlers
- In baffling move, TrueCrypt open-source crypto project shuts down
- 'Oleg Pliss' hack makes for a perfect teachable IT moment
- Give IE the heave-ho until Microsoft patches zero-day
- Hackers find first post-retirement Windows XP-related vulnerability
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!