Governments Advise Against Internet Explorer
Posted by aonenetworks On April 30, 2014
It seems like bugs are a common occurrence in cyberspace recently and the latest affects the world’s most popular web browser, Internet Explorer.
Software giant Microsoft recently confirmed that a previously unknown, unpatched flaw exists in their flagship web browser. The flaw has been termed “Operation Clandestine Fox’ and it potentially allows attackers to install malware on PC’s around the world without the owner’s permission. The malware could then be used to track online behaviour, steal personal information or even remotely gain control of a computer.
Bad News for Internet Explorer 6 and Above
The majority of Internet Explorer users will be affected by this bug. Security firm FireEye, who discovered the bug, said it is mainly being used with Internet Explorer 9, 10 and 11 which are distributed with Microsoft’s Windows Vista, Windows 7 and Windows 8 although it affects all Internet Explorer versions from 6 upwards.
FireEye have said that a sophisticated group of hackers have been using the bug to target U.S based firms thought to be in the financial and defence sectors. They have described the hackers as “extremely proficient at lateral movement’ and “difficult to track’.
A FireEye spokesman said “It’s unclear what the motives of this attack group are, at this point. It appears to be broad-spectrum Intel gathering’.
Security firm Seculert are concerned that other hackers will now be racing to exploit the bug and launch similar attacks before Microsoft release a patch. “Microsoft should move fast’, they said. “This will snowball’.
Stop Using Internet Explorer
The threat is considered so serious that the US and UK governments have taken a rare step and advised users to stop using Internet Explorer and consider alternative browsers until the bug is patched.
FireEye, the security firm who discovered the bug, have recommended that if users cannot switch browsers, they should at least disable Internet Explorer’s Flash plugin. They have also suggested using IE with the Microsoft Enhanced Mitigation Experience Toolkit (EMET) app, but have advised that this will not be as secure as simply switching browsers.
Microsoft, who recently released Security Advisory 2963983 to notify users of the threat, said:
“At this time we are aware of limited, targeted attacks. We encourage customers to follow the suggested mitigations outlined in the security advisory while an update is finalized.”
Microsoft have confirmed that using the Enhanced Protected Mode included with IE 10 and IE 11 along with the EMET app will help protect against any potential risks. No advice has been issued to users of IE 9 or older and it’s unlikely that users of IE 6 will ever see a patch after Microsoft recently stopped issuing security updates for the browser.
There is no evidence that hackers will be targeting home users and the attacks witnessed so far seem to be aimed at a specific group of companies; however the main advice seems to be that users should immediately stop using Internet Explorer until a patch is released. For those users of older IE versions now might be the time to look into permanently switching to one of the free alternative web browsers such as Google Chrome or Mozilla Firefox.
