Attackers are breaking into Microsoft Windows computers using a newly discovered vulnerability in Internet Explorer, security experts warn. While the flaw appears to have been used mainly in targeted attacks so far, this vulnerability could become more widely exploited if incorporated into commercial crimeware kits sold in the underground.
In a blog posting Friday evening, Milpitas, Calif. based security vendor FireEye said it found that the Web site for the Council on Foreign Relations was compromised and rigged to exploit a previously undocumented flaw in IE8 to install malicious software on vulnerable PCs used to browse the site.
According to FireEye, the attack uses Adobe Flash to exploit a vulnerability in the latest (fully-patched) version of IE8. Dustin Childs, group manager for response communications at Microsoft, said the vulnerability appears to exist in previous versions of IE.
?We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8,? Childs said in an emailed statement. ?We will take appropriate action to help keep customers protected once our analysis is complete. People using Internet Explorer 9-10 are not impacted.?
As FireEye notes, this is another example of a ?watering hole? attack, which involves the targeted compromise of legitimate websites thought to be of interest to or frequented by end users who belong to organizations that attackers wish to infiltrate. Earlier this year, I wrote about similar zero-day attacks against visitors to the Web sites of the National Democratic Institute, The Carter Center, and Radio Free Europe.
Update, Dec. 30, 9:25 a.m. ET:?Microsoft has officially acknowledged this vulnerability in an advisory, which contains some advice for IE users about how to mitigate the threat from the flaw.?As IE versions 9 and 10 are not impacted, users running Windows Vista or higher can upgrade to the latest browser version here.
Tags: Adobe Flash, Council on Foreign Relations, Dustin Childs, FireEye, IE 0day, IE8, Internet Explorer 0day, KB2794220, microsoft, Microsoft Windows, watering hole attacks
Source: http://krebsonsecurity.com/2012/12/attackers-target-internet-explorer-zero-day-flaw/
dwight howard trade ncaa bracket 2012 2012 ncaa bracket john carlson greg smith catamount mike dantoni
No comments:
Post a Comment