Widespread attacks exploit newly patched IE bug
The first widespread attack to leverage a recently patched flaw in Microsoft's Internet Explorer browser has surfaced.
Starting late Wednesday, researchers at antivirus vendor Symantec's Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.
Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.
As of midday Thursday, Symantec had spotted hundreds of Web sites that hosted the attack code, typically on free Web-hosting services or domains that the attackers had registered themselves.
The IE flaw being leveraged in these attacks was also used to hack into Google's corporate network last December. It has been linked to similar incidents at 33 other companies, including Adobe Systems. Microsoft patched the vulnerability in an emergency security update Thursday morning.
The Google attack hit IE 6 on Windows XP, but over the past week hackers have found ways to exploit the flaw on more recent versions of the browser as well. These latest techniques do not appear to be used on the Web sites Symantec has uncovered. They use the IE 6 exploit code, Talbot said.
Still, with IE 6 still being widely used, the move to more widespread attacks is worrying. "It may be an indication that attackers have finally ramped up their attack toolkits and are now ready to launch widespread attacks," Talbot said.
He believes that the criminals are tricking victims into visiting their Web sites by sending spam e-mail or instant messages with links to sites.
On Thursday, Websense published some sample e-mails used in targeted attacks that exploit the IE bug. A typical subject line is "Helping You Serve Your Customers." The e-mail reads, "I just heard the news: Helping you serve your customers" and includes a link to the malicious Web site.
The e-mails contain spoofed e-mail addresses, designed to fool victims into thinking that they were sent by a colleague. The malicious Trojan used in the attack is not the same one that was used in the Google attack, however.
Websense has seen these e-mails sent to targeted companies in the U.S. and the U.K., said Patrik Runald, a security research manager with Websense. "These attacks are actually continuing; they happened today; they happened yesterday and they happened the day before."
However, Websense believes that the e-mails it has tracked are part of a small-scale targeted attack, similar to those used on Google and Adobe in attacks that are ongoing. Websense has counted only about 25 malicious Web sites to date, but the number is rising fast, Runald said.
Security experts believe this more targeted technique is used as part of a systematic cyber-espionage campaign, which some have linked to China.
IDG News Service
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @ITworld
On Twitter now
Symantec
Powered by TwitterOn Twitter now
Symantec
Brian Proffitt
openSUSE: Not for sale today
pasmith
Two new sources fuel the Verizon iPhone rumor mill
sjvn
The Corporation has gone Open Source
Mike Elgan
What to do with your Google 'Social Circle'
Sandra Henry-Stocker
Unix How To: Give me that old-time security!
Dan Tynan
What's worse than privacy legislation? No privacy legislation
The IFA consumer electronics exhibition turns 50
Albert Einstein opened the 7th Great German Radio and Phonograph Show, the forerunner to today's IFA, in Berlin in 1930. The show marked the public debut of a prototype 'television receiver.' Since then, some products, like the 3DTV, were ahead of their time. Others, like the MiniDisc...well, just never got off the ground. Here's a look at IFA's storied past.
IFA 2010
Samsung launches Galaxy Tab
3D content is king at giant tech show
PlayStation 3 will be ready for 3D by October
Sony announces music service, hints at TV service
Google's Schmidt to speak at Berlin show
3D, tablets galore expected at consumer electronics show
With all the attacks
With all the attacks surfacing, all involving Internet Exploder, why are people STILL using IE? Logic would suggest switching to another browser until M$ can get their sh*t together and release a secure browser.It's simple...
Because some people are brainwashed into thinking they have to except computer insecurity. There are still those that go baaah to what ever Microsoft says.I know this might come as a shock.
But there are bad people in this World. No software is bullet proof. That does *not* mean that IE is as bullet proof as Firefox or all the other browsers. It's not. Bad people continue to sell a browser that has far more security holes than all the other browsers combined. Other bad people use those security holes to make malware to infect the security challenged browser. Lazy, uninformed people, continue to buy unsafe software when free and better software is available.Any article on a new virus/trojan should emphasize that the cybercriminals are not in control of computer security. The company who sells the affected software IS!
Microsoft has been getting a free ride now for decades. They are the security problem. They made the computer security industry the huge success it is now. Huge success equals huge money, huge money siphoned off our economy.
This is the kind of article that invites the "popularity" logic of the feeble minded. Let's see if he shows.