 |
Over the weekend, there were reports of exploits appearing for the drive-by Internet Explorer security hole reported last week. Now they are cropping up in a lot of unexpected places. Brian Krebs at the Washington Post:
More than 200 Web sites — many of them belonging to legitimate businesses — have been hacked and seeded with code that tries to take advantage of a unpatched security hole in Microsoft’s Internet Explorer Web browser to install hostile code on Windows computers when users merely visit the sites.
In an update to its Security Response Web log, Microsoft security program manager Stephen Toulouse said the attacks Redmond is seeing against the IE flaw “are limited in scope for now and are being carried out by malicious Web sites.”
I have to call Microsoft out on both counts, and I think some of what I’ve uncovered so far about these attacks should make it clear that the situation is serious and getting worse by the hour.
According to a list obtained by Security Fix, hackers have infected at least 200 sites, many of which you would not normally expect to associate with such attacks (i.e., porn and pirated-software vendors). Among the victims are a regional business council in Connecticut, a couple of vacation resorts in Florida, a travel-reservation site, an online business consultancy, an insurance company, and a site featuring things to do at various cities across the country.
Many more details by following the link including reports from victims. Steven J. Vaughan-Nichols asks, “Why Is Anyone Still Using Internet Explorer?” Even accounting for hyperbole, now might be a good time to try a different browser for a while.
| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
| « Dec | ||||||
| 1 | 2 | 3 | ||||
| 4 | 5 | 6 | 7 | 8 | 9 | 10 |
| 11 | 12 | 13 | 14 | 15 | 16 | 17 |
| 18 | 19 | 20 | 21 | 22 | 23 | 24 |
| 25 | 26 | 27 | 28 | 29 | 30 | 31 |
March 28th, 2006 at 12:19 AM
Attacks on Unpatched IE Flaw Escalate
More than 200 Web sites — many of them belonging to legitimate businesses — have been hacked and seeded with code that tries to take advantage of a unpatched security hole in Microsoft’s Internet Explorer Web browser to install hostile code on Windo…
March 28th, 2006 at 10:02 PM
[...] There’s a gaping drive-by Internet Explorer security exploit that cropped up without any prior warning and is now appearing all over the Web. Microsoft unhelpfully says don’t surf in any sleazy areas and we’ll have a patch next month on our regularly scheduled Patch Tuesday. Commentators note that with hacked web servers, exploits are appearing in the nicest neighborhoods and as a result, security companies are coming out with their own patches ([1], [2]) of which Microsoft disapproves. Nonetheless, Microsoft says they may well ship their own patch early if things look really, really serious. [...]
April 11th, 2006 at 8:39 PM
[...] The 8 drive-by exploits included the one reported last month where hacked everyday web sites were being used as the shadowy “malicious web sites” Microsoft seems to be so fond of warning against. [...]