Users of Microsoft's Internet Explorer have been warned of a flaw that could let hackers gain access to their computers and steal personal data, and told them to swap to a rival browser.
The flaw was spotted last week when hackers started attacking users of IE 7. The flaw, however, has also been found in earlier versions of Microsoft's browser, IE 5 and IE 6.
Because IE is used by seven out of every ten computers in the world, the flaw is potentially very serious. So far, however, it only seems to have been used to steal computer game code from rival gamers.
Microsoft is trying to put together a patch, but in the meantime computer users have been advised to update their security settings or switch to unaffected browsers such as Firefox or Opera.
The latter scored highest in a recent set of tests of how browsers deal with password security, by security consultants Chapin Information Services. Firefox came second with IE mid-table. Google's new browser, Chrome, and Safari 3.2 for Windows tied in last place.
The flaw in IE allows criminals to gain control of computers that have visited a website infected with malicious code designed to exploit it. While restricting web surfing to trusted sites should reduce the risk of infection, the malicious code can be injected into any website. Users do not have to click or download anything to become infected, merely visiting an infected website is sufficient.
Antivirus software specialists Trend Micro believe as many as 10,000 sites have been hacked to exploit the flaw. Sites that have been compromised so far, however, are mostly Chinese and the attackers seem intent on stealing people's computer game passwords in order to sell them on the black market rather than looking for personal details such as bank accounts.
It is known as a "zero-day" attack because it exploits a security vulnerability on the same day that the vulnerability became generally known. Usually there is a "window of vulnerability" between when the flaw is discovered and when the vendor issues a patch. The hope is that the vendor issues the patch before writers of so-called "malware" can exploit the flaw. If the malware writers have the flaw first, then the vendor has "zero days" to create a patch.
"Microsoft is continuing its investigation of public reports of attacks against a new vulnerability in IE," the company said in a security alert updated yesterday. "We are actively investigating the vulnerability that these attacks attempt to exploit. We will continue to monitor the threat environment and update this advisory if this situation changes."
"On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs."
refer: guardian.co.uk
Posts
