Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Updated: A zero day vulnerability has been discovered that targets Microsoft Internet Explorer and is under active attack.
The exploit was found by researcher Eric Romang on public servers operated by perpetrators behind the Chinese Nitro attacks last year that targeted the chemical industry.
It works by dropping the file exploit.html which creates an .img and .swf file which Internet Explorer handles as Flash.
The exploit does not affect version 10 of Internet Explorer, the upcoming version of the browser which was open for testing. It works on all Microsoft operating systems.
Microsoft recommended users block ActiveX.
"Set internet and local intranet security zone settings to 'high' to block ActiveX Controls and Active Scripting in these zones," Trustworthy Computing director Yunsun Wee said in a blog post.
"Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones."
These mitigations would prevent exploitation but could affect usability. Wee said trusted sites should be added to the IE Trusted Sites zone to minimise disruption.
The exploit was quickly added to Rapid 7’s penetration testing framework Metasploit. Developers there worked with contributor Romang to understand the exploit.
The vulnerable version 9 of Internet Explorer was the dominant browser in Australia, according to StatCounter, with about a quarter of users running the software.
Metasploit developer Sinn3r posted screenshots of the exploit in action.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.