New IE hole could perfect phishing scams
It allows attackers to create a fake Web site that looks like a genuine site
December 20, 2004 12:00 PM ETIDG News Service -
SAN FRANCISCO -- A newly reported security problem in Microsoft Corp.'s Internet Explorer Web browser allows attackers to create a fake Web site that looks exactly like a genuine site.
The vulnerability lets an attacker display any Web site while the address bar in Internet Explorer displays a trusted Web address -- https://www.paypal.com, for example -- and even shows the icon indicating that Secure Sockets Layer security technology is in use, security researchers warned on Thursday.
The flaw could result in more sophisticated phishing scams, which are online attacks that typically use spam e-mail messages with links to phony Web pages that look like legitimate e-commerce sites, where users are duped into revealing sensitive information such as passwords and credit card numbers.
The problem was discovered by a security researcher from the Greyhats Security Group and reported by Danish security company Secunia. The vulnerability lies in an ActiveX control in Internet Explorer and has been found to affect Version 6.0 of the browser running on Windows XP with Service Pack 2 and earlier versions, according to a Secunia advisory.
Microsoft is investigating the report, a company spokeswoman said Friday. "We have not been made aware of any attacks attempting to use the reported vulnerabilities or customer impact at this time, but we are aggressively investigating the public reports," she said.
Upon completion of this investigation, Microsoft may provide a fix as part of its monthly release of patch updates or as an out-of-cycle security update, she said. Meanwhile, Secunia suggests that users protect themselves by disabling ActiveX in Internet Explorer or setting the Internet Explorer security level to "high" for the Internet zone.
Banks are trying to combat phishing by educating their customers. For example, Citibank has a warning on its Web site that advises customers not to click on links in e-mail messages. Also, Citibank advises customers to manually enter the Web address for the bank in a Web browser to make sure they are dealing with Citibank and not a scammer.
Reprinted with permission from
Story copyright 2009 International Data Group. All rights reserved.
Security
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
The State of PCI DSS Compliance at Organizations Today
Download this resource today!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Can Heuristic Technology Help Your Company Fight Viruses?
What is Heuristic Technology and how can it help safeguard your business against viruses? Learn more.
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Why Email Must Operate 24/7 and How to Make This Happen
Learn how to avoid an email outage by implementing a hosted email continuity solution.
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Eradicate Spam & Gain 100% Asurance of Clean Mailboxes
Get this paper now!
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Mastering eDiscovery: The IT Manager's Guide to Preservation, Protection & Production
Get this paper now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
