Internet Explorer UsersAt Risk Again

It’s not been a good start to the year for Internet Explorer!

January bared witness to what is being called the ‘Google v China war’. On January 12th, Google released a blog called “a new approach to China” claiming that China had been making sophisticated computer attacks from Taiwan on U.S. businesses and Chinese Human Rights activists. Google said that it was reporting the attacks because they were concerned about freedom of speech, and is in discussion with the Chinese government regarding removal of their censorship programs it placed over its search engine at China’s request. They have also threatened to shut down Google.cn and close their offices in China, pulling out of China altogether.

The significant factor in this case is that the attacks were performed through a known Internet Explorer ‘zero-day vulnerability’ i.e. a software security flaw for which there is currently no patch. Microsoft posted an advisory about the new vulnerability and issued a statement confirming that hackers breached Google and other unspecified companies using it. The company indicated the flaw was not affecting certain IE versions, was difficult to exploit in others but was seeing “targeted and limited attacks exploiting IE6”.

At the beginning of February, the Department of Health warned NHS staff to avoid the nearly decade-old IE6, while the governments of Germany and France have urged citizens to upgrade or switch. Technology experts said that home users should consider using other browsers, such as Firefox or Google Chrome, on their home computers.

February also saw IE6 finally being knocked off the top spot of the worldwide browser rankings, according to Net Applications stats. Around the same time, Google announced they were dropping support for their Apps through IE6 as they look to encourage adoption of more advanced browsers.

Once again, users of Internet Explorer are at risk. Last week Microsoft discovered a vulnerability that could allow a hacker to turn your system into a file server for your private documents, simply by redirecting them to a fake website loaded with malicious code. Once the unsuspecting user clicks on the web page, the code is automatically downloaded to their machine, giving hackers “backdoor” access into the computer and all of its files and documents. The vulnerability was first discussed at last week’s Black Hat DC conference by Jorge Luis Alvarez Medina, a security consultant with Core Security Technologies. Microsoft says the risk is highest for IE users running Windows XP or who have disabled the browser’s Protected Mode feature.

Microsoft have been informed of the problem, but the experts who discovered the most recent flaw will not release full details until Microsoft has released a patch that will fix it. While Microsoft claim customers are at “reduced risk due to this responsible disclosure”, the experts warn that the flaw was “remarkably easy” to exploit.

Microsoft claim that only users running Windows XP are at risk from the vulnerability and they recommend users enable a feature known as “network protocol lockdown”. They also say that users running Internet Explorer 7 and Internet Explorer 8 in Protected mode are not at risk, nor are those running Windows Vista and the most recent Microsoft Operating System, Windows 7. It is thought that Microsoft will release a software update to fix the vulnerability sometime this week.