Active exploits targeting social networking ActiveX flaw

Powered by SC Magazine
 

Users who remain vulnerable to an ActiveX photo uploader vulnerability used on many websites are now being targeted in active attacks, researchers from Symantec said today.

On Friday, researchers said they first noticed in-the-wild attacks taking advantage of the vulnerability, which has been patched, said Kevin Haley, director of product management for Symantec Security Response.

Under the attack scenario, individuals receive phishing emails that direct them to a bogus MySpace login page, Haley told SCMagazineUS.com today. Once there, the malicious sites search victims' computers to learn if they are vulnerable to the image uploader issue. If they are, the site attempts to install a medley of trojans.

“It's a double whammy,” he said. “It's going to try to steal your credentials [MySpace username and password] and it's going to try to download some malware on your machine.”

An Aurigma representative did not respond to a request for comment.

If users are not running the Aurigma software – or if their PCs are pached for the flaw – the sites will look for other vulnerabilities including a recently disclosed Yahoo Jukebox ActiveX flaw.

Haley said businesses might consider disabling ActiveX on their browsers, but ideally they should ensure their machines are running the latest fixes.

“Once the patches are available, you need to get them out,” he said. “The bad guys and the malware writers are where the users are, and today that's the social networks.”

See original article on scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
CBA sued over frozen millions in IT bribery scandal
Eric Pulier's not-for profit lodges lawsuit in US.
 
NewSat's Lockheed Martin satellite contract cancelled
No certainty as to refinancing for struggling company.
 
Don’t mention digital disruption to David Whiteing
Buzzwords don’t curry favour with CBA's new CIO - it’s all just innovation to him.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 641

Vote