MAJOR SECURITY FLAW JUST DISCOVERED IN INTERNET EXPLORER (IE)

Users are urged to switch immediately! The problem was discovered about 36 hours ago. The flaw allows thieves to steal your password. I work with information technology and my password has been stolen before. It’s a huge hassle to say the least since I had to estimate the severity of the damage after several of my passwords were stolen. May I recommend a free application that has done a great job of protecting me since then? The application (or program) is called “Spybot.” There’s a link to it at the end of this posting.

This post was updated on Dec. 17.

The security flaw allows hackers to steal passwords. Some 10,000 websites have code that can exploit the flaw.

Here are links to several stories:

Microsoft: Microsoft Security Advisory (961051)

Microsoft is continuing its investigation of public reports of attacks against a new vulnerability in (the web browser) Internet Explorer. Blah, blah, blah... (It continues in very sterile language. The other links state the severity and urgency of the problem in plain language.)

BBC News: Serious security flaw found in IE

Users of Microsoft’s Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed.

The flaw in Microsoft’s Internet Explorer could allow criminals to take control of people’s computers and steal their passwords, internet experts say.

Microsoft urged people to be vigilant while it investigated and prepared an emergency patch to resolve it.

Computerworld: Microsoft preps emergency IE patch for Wednesday release

December 16, 2008 (Computerworld) Microsoft Corp. announced today that it will issue an emergency patch tomorrow to quash a critical Internet Explorer bug that attackers have been exploiting for more than a week.

The advance warning came less than a week after Microsoft acknowledged that exploit code had gone public and was being used by hackers to hijack Windows PCs running IE.

Microsoft will deliver the out-of-cycle patch Wednesday at 1 p.m. Eastern time via its normal update mechanisms, including Windows Update, Microsoft Update and Windows Server Update Services.

The update will be pegged “critical,” the most serious ranking in Microsoft's four-step scoring system.

Even as it declared that it would release an emergency fix, Microsoft continued to downplay the threat. “At this time, we are aware only of attacks that attempt to use this vulnerability against Windows Internet Explorer 7,” said company spokesman Christopher Budd in an e-mail today.

Initially, Microsoft and other security companies believed that only IE7 was vulnerable to attack, but on review, the company confirmed that all versions of its browser, including IE5.01, IE6 and IE8 Beta 2, contain the bug.

Last weekend, Microsoft researchers said that they had seen a “huge increase” in attacks, and that some were originating from legitimate Web sites. Another researcher added that about 6,000 infected sites were serving up exploits that target the IE vulnerability.

Also today, Microsoft confirmed that attacks could be launched through Outlook Express, a free e-mail client bundled with Windows XP. Because Outlook Express renders HTML-based messages using IE’s engine, attackers could exploit the bug by getting users to open or view malicious messages.

New York Times: Microsoft Issuing Emergency Fix for Browser Flaw

REDMOND, Wash. (AP) -- Microsoft Corp. is taking the unusual step of issuing an emergency fix for a security hole in its Internet Explorer software that has exposed millions of users to having their computers taken over by hackers.

The “zero-day” vulnerability, which came to light last week, allows criminals to take over victims’ machines simply by steering them to infected Web sites; users don’t have to download anything for their computers to get infected, which makes the flaw in Internet Explorer’s programming code so dangerous. Internet Explorer is the world’s most widely used Web browser.

Microsoft said it plans to ship a security update, rated “critical,” for the browser on Wednesday. People with the Windows Update feature activated on their computers will get the patch automatically.

Thousands of Web sites already have been compromised by criminals looking to exploit the flaw. The bad guys have loaded malicious code onto those sites that automatically infect visitors’ machines if they’re using Internet Explorer and haven’t employed a complicated series of workarounds that Microsoft has suggested.

Microsoft said it has seen attacks targeting the flaw only in Internet Explorer 7, the most widely used version, but has cautioned that all other current editions of the browser are vulnerable.

Microsoft rarely issues security fixes for its software outside of its regular monthly updates. The company last did it in October, and a year and half before that.

Cnet: Critical IE 7 exploit making the rounds

Microsoft issued a critical security warning Tuesday that a malicious exploit is making the rounds and attacking vulnerabilities in Internet Explorer 7.

The risk is believed to be widespread, given that IE 7 is the latest version of Microsoft’s browser and is bundled with XP service pack 3 and also Vista, said Dave Marcus, director of security research and communications for McAfee's Avert Labs.

The AZN Trojan, which has been making the rounds since the first week of December, has the potential of infecting users’ system with a Trojan horse, or “downloaders” that can download other forms of malware onto a user’s system.

Microsoft announced it will release a security patch Wednesday via its automatic update system to patch users computers.

Users can potentially get infected two ways, Marcus said. One is to visit a malicious Web site that already has the malware installed on the site, or visit a legitimate site, in which the attacker has inserted the malicious script to run in the background, leaving visitors unaware their systems have been compromised.

“A lot of Web sites are pushing out this exploit,” Marcus noted. Some of the infected sites include Web sites that offer free wallpaper for mobile phones to sites that feature property to product-related sites.

Microsoft is encouraging users to update their systems once the patch is released Wednesday at 10 a.m. PDT.

A SUGGESTION

If you still use IE, stop using it until you learn that it’s safe once again. On the other hand, why not just switch to another web browser? It wouldn’t be a bad idea to make any of these other browsers your primary browser and use IE only as your secondary browser.

These browsers are listed in order of popularity. All of them are safer, relatively speaking, than Internet Explorer. Another bonus: all of them work faster than IE.

1. Firefox
2. Opera
3. Google Chrome
4. Apple Safari

Earlier, I mentioned my bad experience with stolen passwords. I looked around for an anti-spyware program and found Spybot. I recommend Spybot. I find it so useful that I donate to it. The application is free and it serves me well.

MICROSOFT’S TECH SUPPORT

The outcry against employing foreign workers.

Everywhere you turn around, it seems, IT professionals are concerned that their jobs will be outsourced. In many cases, this outsourcing goes offshore to foreign workers. Alternatively, foreign IT talent is imported through the much-reviled H1-B visa. (The H-1B is a non-immigrant visa. It allows US employers to employ foreign guest workers in specialty occupations.)

From an academic point of view, offshoring is a phenomena that reflects the growing globalization of resources. Work that was previously done by Americans has now been shifted to foreign-based workers. This kind of work varies from the high-end, application development (or what used to be called “programming” before) to the customer-intensive (call centers) to the mundane but necessary (transcripting of medical records). The latter transcribes the spoken notes of the physician to written form. There are several advantages to the offshoring trend. First, rates inexpensive relative to American wages. Second, these are the rates paid to numerous skilled English-speaking educated workers. And third, most offshoring destinations are in Asia—principally India and the Philippines. When it’s night time here, it’s day time there. That allows work to be literally turned over overnight.

Let’s recognize that offshoring is not a new practice. It’s never been on the radar as prominently as it is now because in the recent past, offshoring involved manufacturing jobs—many of which required technical expertise. A good example is Boeing. Many airplane components are built overseas—not in Asia but in Europe. That’s offshoring too.

Offshoring is a major burden for Americans who lose their jobs. However, economically speaking, it makes a lot of sense. Offshoring is a part of the trend towards specialization in skilled services. In fact, it’s easier understood when you think of it as international trading in services.

The US has a sizable trade surplus with other nations. In fact, we have a trade surplus in services only. In goods, we have huge deficits with the rest of the world.

The US “wins” by specializing in high-value services such as transportation (UPS, FedEx, and DHL), accounting (Ernst & Young which are respected names around the world), consulting (McKinsey & Co.), and others. As a country, we trade away our lower-value services, such as call centers and data entry work (of which medical transcription is one of them) in exchange for high-value services.

Offshoring increases the demand for complementary jobs in the US. The lower cost of time-intensive transcription work reduces the cost of that piece of medical administration. And heaven knows how much more we need to reduce that cost. Complementary jobs take the form of nurses, physician assistants, therapists, and the like. If transcription work wasn’t offshored, these jobs would be in short supply. (They already are so the problem would be exacerbated!) Offshoring has another less apparent benefit. The cost advantage it gives American companies make them more competitive in the global market. Offshoring jobs may actually be thought of as importing competitiveness.