Hackers target IE7
Connecting state and local government leaders
Software security firm Trend Micro has reported that hackers are targeting a hole in Internet Explorer 7 that Microsoft addressed in the security patch it issued last week.
Software security firm Trend Micro has reported that hackers are targeting a hole in Internet Explorer 7 that Microsoft addressed in the security patch it issued last week.
The attack uses a malicious Microsoft Word .doc file packing an ActiveX object to direct users' browsers to a Web site containing malicious HTML code. Microsoft Security Bulletin MS09-002, part of the patch released last week, can protect IE7 users against the malicious HTML code — if the patch is installed.
The vulnerability stems from the way IE handles deleted cookies, data and Web pages, which causes an error that enables hackers to run a remote code execution exploit. The news comes less than two months after Microsoft issued an off-cycle patch to fix other vulnerabilities in the browser.
Security experts, including Trend Micro's Jake Soriano and nCircle's Andrew Storms, say it is important to install the previously released patch now. They add that this smaller exploit could be the first of many such attacks given that more than 25 percent of all Web surfers use IE7. In this case, the malware authors are targeting the time between patch release and installation.
"This exploit code is not good news for enterprises," Storms said. "Not even a week has gone by since Patch Tuesday, and we already have in-the-wild exploit code. This, along with the wildfire spread of the Conficker worm, is a perfect example of how long it takes enterprises to deploy patches."
Security researchers have facetiously referred to the day after a patch release as Exploit Wednesday. However, they are beginning to take more seriously the notion that hackers are looking at patches, finding weaknesses and creating exploits.
Qualys studied data on how quickly users installed IE patches and found that they sometimes treated such browser fixes with less urgency than patches for other applications.
Given the increase in browser-borne exploits, Microsoft might want to adjust the patching cycle for IE, said Wolfgang Kandek, Qualys' chief technical officer. He suggested that a daily automatic update check for Internet Explorer would be beneficial for its millions of users.
Microsoft “should enable fast patching for IE in a way similar to other browser vendors, such as Google's Chrome and Mozilla's Firefox, which require little or no interaction from the user," Kandek said. “IE8 could be a great opportunity to investigate such a capability.”
With such a process in place, security administrators and Web application developers could decrease the time hackers have to take advantage of unpatched systems and likely help stave off future exploits.
Bojan Zdrnja, a security researcher at the SANS Institute, said he believes that in this case, hackers waited for the patch and then reverse-engineered the code looking for the weakness it was meant to fix.
"The exploit targets Internet Explorer 7, but so far it has been delivered to the end user as a Word document," Zdrnja wrote in his blog on the institute’s Internet Storm Center Web site. "That being said, there is absolutely nothing preventing attackers from using the exploit in a drive-by attack, and we can, unfortunately, expect that this will happen very soon."
Because hackers seem to be taking advantage of Exploit Wednesday, Storms suggests that IT pros establish enterprise-specific fail-safe programs for the time between patch release and installation.
"If your security team can't speed up your patch deployment process, then it's time to start thinking about other ways to help mitigate the risk," he said.
NEXT STORY: Energy completes science network upgrade