German cybersecurity agency prods users to ditch IE

Computerworld - Germany's cybersecurity agency on Monday urged users to drop Internet Explorer (IE) and switch to a rival, like Chrome or Firefox, until Microsoft patches a new critical bug in its browser.

In an alert released Monday, Germany's Federal Office for Information Security, known by its German initials of BSI for "Bundesamt fuer Sicherheit in der Informationstechnik," noted that the unpatched vulnerability is already being exploited by hackers, and that "the attack code is freely available on the Internet."

BSI then advised users to stop running IE for now.

"The BSI recommends all users of Internet Explorer use an alternative browser ... until [Microsoft] has released a security update," the watchdog agency said.

"I think it's a bit too early to panic," said Andrew Storms, director of security operations at nCircle Security, when asked to comment on BSI's advice. "Granted, if the attacks escalate and the patch takes too long [to arrive] for comfort, then making the switch to another browser, at least temporarily, is a simple way to mitigate the threat."

According to Microsoft, IE6, IE7, IE8 and IE9 running on Windows XP, Vista and Windows 7 all contain the remote code execution vulnerability. IE10, the browser bundled with Windows 8, is free of the bug, however.

In a security advisory released late Monday, Microsoft offered customers several temporary workarounds to protect IE against attacks now circulating. One of the workarounds, said Microsoft, is to deploy EMET 3.0 (Enhanced Mitigation Experience Toolkit), a utility unsuitable for most consumers.

Microsoft has promised to patch the vulnerability, but has declined to set a timetable. Some security experts believe the company is hustling to craft and test a so-called "out-of-band," or emergency, update that will be delivered before Oct. 9, the next regularly-scheduled Patch Tuesday.

Hackers have been exploiting the bug for an unknown length of time.

Other national computer security agencies, including US-CERT (United States Computer Emergency Readiness Team) and France's CERTA (Centre d'Expertise Gouvernemental de Reponse et de Traitement des Attaques informatiques), did not ape BSI's advice.

Instead, US-CERT and CERTA each recommended that users take Microsoft's advice, and rely on EMET and various settings changes to protect themselves.

BSI has been quick to pull the trigger on browser-switching advice in the past.

In January 2010, BSI and several other countries' security organizations urged users to dump IE and run a rival while Microsoft worked on a patch.

The underlying IE vulnerability in that incident had been exploited by hackers to break into the corporate network of Google and other major Western companies. Google alleged that the attacks were launched by Chinese attackers.

Some security professionals, however, have suggested the same browser switch that BSI counseled. HD Moore, chief security officer at Rapid7, and the creator of the Metasploit penetration testing toolkit, advocated that strategy on Monday.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.