Print
Discuss
Send to friend
RSS feeds
Daily news podcastThe pressure on Microsoft to release an out-of-cycle patch for an IE flaw which allowed Chinese hackers to attack Google's systems continues to grow, after authorities in France joined the German government in urging citizens to use an alternative browser.
Microsoft admitted late last week that the hack of Google's systems revealed on Tuesday was caused by a vulnerability in version 6 of its popular browser.
"The vulnerability exists as an invalid pointer reference within Internet Explorer," read a Microsoft security advisory.
"It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution."
It later emerged that the exploit code for the flaw had made its way onto the internet, increasing the likelihood of copycat attacks.
The French and German authorities are now urging their citizens to use an alternative browser until the flaw is fixed, and the pressure on Microsoft to release an out-of-cycle patch is growing.
However, Microsoft is continuing to advise users to upgrade to the latest version of the browser, which appears to be unaffected by the vulnerability.
Graham Cluley, senior technology consultant at security vendor Sophos, warned that switching browsers may cause more problems than it solves in many cases.
"If your IT department doesn't already formally support an alternative brow ser, and if your users aren't already familiar with the other browser, you may be causing more problems than it's worth by summarily switching browsers," he wrote in a blog posting today.
"You may also have web-based applications that don't work well, or even at all, unless they are accessed with Internet Explorer. That's not going to be good for productivity. And finally, what if your replacement browser itself turns out to contain a vulnerability? Are you going to switch again?"
See also:
'Targeted and co-ordinated nature of the attack' marks it out, says George Kurtz 18 Jan 2010
Alibaba Group, which owns Yahoo China, describes Yahoo's comments as 'reckless' 17 Jan 2010
State department spokesman reveals diplomatic tension between two superpowers 16 Jan 2010
Attack could be linked to similar incident last year involving around 100 Silicon Valley firms, says iDefense 13 Jan 2010All Hacking Tags: Threats, Ie, Sophos, Microsoft, Google, China, Security, Software, Strategy
del.icio.us
Digg this
reddit!
