MAJOR SECURITY FLAW JUST DISCOVERED IN INTERNET EXPLORER (IE)Users are urged to switch immediately! The problem was discovered about 36 hours ago. The flaw allows thieves to steal your password. I work with information technology and my password has been stolen before. It’s a huge hassle to say the least since I had to estimate the severity of the damage after several of my passwords were stolen. May I recommend a free application that has done a great job of protecting me since then? The application (or program) is called “Spybot.” There’s a link to it at the end of this posting.
This post was updated on Dec. 17.
The security flaw allows hackers to steal passwords. Some 10,000 websites have code that can exploit the flaw.
Here are links to several stories:
Microsoft: Microsoft Security Advisory (961051)
Microsoft is continuing its investigation of public reports of attacks against a new vulnerability in (the web browser) Internet Explorer. Blah, blah, blah... (It continues in very sterile language. The other links state the severity and urgency of the problem in plain language.)BBC News: Serious security flaw found in IE
Users of Microsoft’s Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed.Computerworld: Microsoft preps emergency IE patch for Wednesday release
The flaw in Microsoft’s Internet Explorer could allow criminals to take control of people’s computers and steal their passwords, internet experts say.
Microsoft urged people to be vigilant while it investigated and prepared an emergency patch to resolve it.
December 16, 2008 (Computerworld) Microsoft Corp. announced today that it will issue an emergency patch tomorrow to quash a critical Internet Explorer bug that attackers have been exploiting for more than a week.New York Times: Microsoft Issuing Emergency Fix for Browser Flaw
The advance warning came less than a week after Microsoft acknowledged that exploit code had gone public and was being used by hackers to hijack Windows PCs running IE.
Microsoft will deliver the out-of-cycle patch Wednesday at 1 p.m. Eastern time via its normal update mechanisms, including Windows Update, Microsoft Update and Windows Server Update Services.
The update will be pegged “critical,” the most serious ranking in Microsoft's four-step scoring system.
Even as it declared that it would release an emergency fix, Microsoft continued to downplay the threat. “At this time, we are aware only of attacks that attempt to use this vulnerability against Windows Internet Explorer 7,” said company spokesman Christopher Budd in an e-mail today.
Initially, Microsoft and other security companies believed that only IE7 was vulnerable to attack, but on review, the company confirmed that all versions of its browser, including IE5.01, IE6 and IE8 Beta 2, contain the bug.
Last weekend, Microsoft researchers said that they had seen a “huge increase” in attacks, and that some were originating from legitimate Web sites. Another researcher added that about 6,000 infected sites were serving up exploits that target the IE vulnerability.
Also today, Microsoft confirmed that attacks could be launched through Outlook Express, a free e-mail client bundled with Windows XP. Because Outlook Express renders HTML-based messages using IE’s engine, attackers could exploit the bug by getting users to open or view malicious messages.
REDMOND, Wash. (AP) -- Microsoft Corp. is taking the unusual step of issuing an emergency fix for a security hole in its Internet Explorer software that has exposed millions of users to having their computers taken over by hackers.Cnet: Critical IE 7 exploit making the rounds
The “zero-day” vulnerability, which came to light last week, allows criminals to take over victims’ machines simply by steering them to infected Web sites; users don’t have to download anything for their computers to get infected, which makes the flaw in Internet Explorer’s programming code so dangerous. Internet Explorer is the world’s most widely used Web browser.
Microsoft said it plans to ship a security update, rated “critical,” for the browser on Wednesday. People with the Windows Update feature activated on their computers will get the patch automatically.
Thousands of Web sites already have been compromised by criminals looking to exploit the flaw. The bad guys have loaded malicious code onto those sites that automatically infect visitors’ machines if they’re using Internet Explorer and haven’t employed a complicated series of workarounds that Microsoft has suggested.
Microsoft said it has seen attacks targeting the flaw only in Internet Explorer 7, the most widely used version, but has cautioned that all other current editions of the browser are vulnerable.
Microsoft rarely issues security fixes for its software outside of its regular monthly updates. The company last did it in October, and a year and half before that.
Microsoft issued a critical security warning Tuesday that a malicious exploit is making the rounds and attacking vulnerabilities in Internet Explorer 7.A SUGGESTION
The risk is believed to be widespread, given that IE 7 is the latest version of Microsoft’s browser and is bundled with XP service pack 3 and also Vista, said Dave Marcus, director of security research and communications for McAfee's Avert Labs.
The AZN Trojan, which has been making the rounds since the first week of December, has the potential of infecting users’ system with a Trojan horse, or “downloaders” that can download other forms of malware onto a user’s system.
Microsoft announced it will release a security patch Wednesday via its automatic update system to patch users computers.
Users can potentially get infected two ways, Marcus said. One is to visit a malicious Web site that already has the malware installed on the site, or visit a legitimate site, in which the attacker has inserted the malicious script to run in the background, leaving visitors unaware their systems have been compromised.
“A lot of Web sites are pushing out this exploit,” Marcus noted. Some of the infected sites include Web sites that offer free wallpaper for mobile phones to sites that feature property to product-related sites.
Microsoft is encouraging users to update their systems once the patch is released Wednesday at 10 a.m. PDT.
If you still use IE, stop using it until you learn that it’s safe once again. On the other hand, why not just switch to another web browser? It wouldn’t be a bad idea to make any of these other browsers your primary browser and use IE only as your secondary browser.
These browsers are listed in order of popularity. All of them are safer, relatively speaking, than Internet Explorer. Another bonus: all of them work faster than IE.
Earlier, I mentioned my bad experience with stolen passwords. I looked around for an anti-spyware program and found Spybot. I recommend Spybot. I find it so useful that I donate to it. The application is free and it serves me well.
No comments:
Post a Comment