New Vulnerability Discovered in Internet Explorer: Updated

[The_root_of_all_evil]

New Vulnerability Discovered in Internet Explorer: Updated

A new security vulnerability in IE allows websites to steal passwords.

Nope, this isn't the Zero Day Attack [http://www.eweek.com/c/a/Security/UPDATED-Microsoft-Issues-Advice-on-Internet-Explorer-ZeroDay-Attacks/], but a vulnerability based off of it. According to the BBC, security advisers are warning people to use different web browsers until the hole can be fixed.

The advice came after Microsoft released a monster patch load repairing 28 critical and important vulnerabilities on its regularly scheduled "Patch Tuesday," which falls on the second Tuesday of every month.

According to Trend Micro [http://uk.trendmicro.com/uk/home/] as many as 10,000 sites have been compromised so far, although most are Chinese according to USA Today [http://www.usatoday.com/tech/news/computersecurity/2008-12-16-internet-explorer_N.htm?csp=34] "What we've seen from the exploit so far is it stealing game passwords, but it's inevitable that it will be adapted by criminals," said Rick Ferguson, Trend Micro's senior security advisor.

Attacks at the moment only seem to be happening to users of Internet Explorer 7, but the vulnerability does exist in earlier versions.

Microsoft is being tightlipped about the actual vulnerability and suggests that anyone wishing to continue using IE7 take appropriate countermeasures, such as working in Protected Mode and changing security settings to High.

Maybe someone got around to using that I.E. Voodoo Doll? [http://nexus404.com/Blog/2007/10/26/make-your-own-internet-explorer-voodoo-doll-a-step-by-step-guide/]

Source :BBC [http://news.bbc.co.uk/1/hi/technology/7784908.stm]

Update: The emergency patch should be available from 1800 GMT on 17 December, Microsoft has said.

Maybe Microsoft need some Christmas Temps?

Permalink

 

[ckeymel]

I want IE to just go away already. I have what some might consider a strong hatred of all things IE.

 

[Fangface74]

The headline could have read "IE still used by some!"

My reaction would have been the same, a slow, sorrowful shaking of the head.

 

[ElephantGuts]

Hey. I use IE. Most of the time. Now I feel bad. And not this apparent password stealing issue nor you people will make me stop using it.

 

[Fangface74]

Hey. I use IE. Most of the time. Now I feel bad. And not this apparent password stealing issue nor you people will make me stop using it.

I'm ok with that, willing targets make it less likely for the rest of us to get shot.

 

[Eternal_Rapture]

Firefox all the way. IE is just annoying.

 

[sirdanrhodes]

Luckily for me I use Chrome isn't it?

 

[Rochnan]

"What we've seen from the exploit so far is it stealing game passwords, but it's inevitable that it will be adapted by criminals," said Rick Ferguson, Trend Micro's senior security advisor.

I find it interesting that in his quote, he doesn't count password theft as a criminal activity -mind that he is a professional security advisor.
I wonder if the law does consider password theft criminal, otherwise there's something awfully wrong here.

 

[Jursa]

I love firefox, over the many many years it hasn't let me down once in either security, comfort or usefulness. Internet explorer is still necessary tho, you know... for 5 minutes after reinstalling your computer.

 

[xitel]

I'm just glad I switched to Chrome all of two weeks ago. I got sick of all the problems I was having with IE and just said screw it.

 

[DamienHell]

IE sucks, who even uses it anymore. Its always had security issues. Mozzila is my choise.

 

[countrysteaksauce]

Firefox has been giving me some problems as of late, so its Chrome for me. Btw, the minimalist design is a good choice, imo.

 

[Dudemeister]

I want IE to just go away already. I have what some might consider a strong hatred of all things IE.

It's sooo crappy....
*read in whiny little kid voice*

 

[Galletea]

That's pretty shocking. I stopped using IE as it crashes every time I use it, but you'd still expect it to be safe. Maybe we should use the Voodoo dolls.

 

[thenumberthirteen]

IE has security issues? Well I for one...

**BREAKING NEWS** We interrupt this forum post to bring you this latest breaking story. Sources have revealed that the Pope is indeed Catholic, and in other news a local Bear has been spotted by woodland conservationists taking a ...

... and I never ate Lobster again.

 

[Bling Cat]

That's pretty shocking. I stopped using IE as it crashes every time I use it, but you'd still expect it to be safe. Maybe we should use the Voodoo dolls.

I stopped using it for the same reason, but I never had any problems with it. Glad I left it when I did now.

 

[TygerFish]

Most people still don't know any better! Remember, friends don't let friends use Internet Explorer. Firefox, Opera, Chrome, a whole new operating system, whatever. It's for their own good.

Here's a helpful analogy: using Internet Explorer is like having unprotected sex with the internet. Yes, I know it makes you feel warm and fuzzy; that's just the viruses.

Once, while setting up a computer for a friend, I was surfing the web with IE while Firefox was downloading. In that short amount of time, it corrupted the system so badly that I had to reinstall everything all over from scratch. Never again.

 

[Radelaide]

Here's a helpful analogy: using Internet Explorer is like having unprotected sex with the internet. Yes, I know it makes you feel warm and fuzzy; that's just the viruses.

LOL. Awesome.

Of course IE is going to have vulnerabilities. It's IE. It's programmed to be hated by its users...

Actually, before I used FF (which has been driving me crazy of late) I used IE without a problem. It crashed a few times, but that was just from me tinkering with the ENTIRE system and not knowing what I was doing.

I guess it all comes down to experience and misfortune with this new thingie.