Microsoft Internet Explorer Security Threat

Follow Up on the Internet Explorer Security Scare

To review

The vulnerability is real; this is an issue to address.

However, there is no need to for mass hysteria.

Some easy to follow Next Steps

The Issue

An “in the wild” exploit has been spotted in Internet Explorer.

The vulnerability is a remote code execution. This exists because of the way Internet Explorer accesses an object in memory that has either been deleted or not properly allocated.

This could result in corrupt memory, thereby creating a vulnerability that may allow an attacker to place and run arbitrary code in the context of the current user within Internet Explorer.

A hacker, attacker, or rapscallious hooligan could host a specially crafted website designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

A remote code execution or RCE is an; like a drive by shooting. All it takes for the RCE to occur is for you to look at booby-trapped content such as a web page or image file can trick IE into launching executable code sent from outside your network, and there won’t be any pop ups or any other obvious warning signs. Sneaky weasels…

What Can You Do?

Do not panic.

First, if you have to access certain sites for work, email, etc…and you know they are legitimate sites, you really should be just fine using I.E. to access these legitimate sites.

Until Microsoft creates a patch for this vulnerability, only use IE to access trusted legitimate websites.

Until Microsoft creates a patch rather than using Google, Bing or other search engines to get to your trusted websites, we recommend using the address window and typing the entire URL out of legitimate trusted sites. This is the safest method to avoid a Redirect Hijack that can also lead to an exploitation of the IE vulnerability.

YouTube, EBay, and other “sales” site can point you to other outside the network websites that may be compromised/hacked websites or simply not legitimate websites.

While using IE you can download Chrome or Mozilla Firefox and use either one of these browsers safely…still using safe internet protocols!

When Microsoft does create a patch for this exploitation, apply it. So be on the watch out for it.

Following these steps should provide a modicum of protection and lessen your chances of an event through this vulnerability. As always CSI Onsite stands ready to aid you should something happen and you find your system compromised.