New IE flaw has faster payload

By

Hackers now are employing new software to more quickly exploit a highly critical Internet Explorer zero-day vulnerability.

The software – posted to the Milw0rm.com website – is based on the createTextRange() flaw, disclosed March 22, which allows malicious attackers to execute code and use the PC as a bot to execute DDos attacks, media outlets reported Monday.


Initial versions of the malware worked slowly, giving users a chance to turn off their systems before the payload was unleashed. But the new software moves much quicker to compromise a system and employs features that are not detected by some anti-virus software.

Microsoft has yet to patch the vulnerability, but at least two vendors – eEye Digital Security and Determina – have issued fixes.

Mike Reavey, security program manager at Microsoft, said last week that the Redmond, Wash.-based computing giant is not seeing an increased spread of attacks and has been active in eliminating malicious websites that are exploiting the vulnerability.

"But attacks are still occurring, so we certainly still recommend up-to-date (anti-virus) software and our safe browsing guidance while we work on the update...," Reavey said on the Microsoft Security Response Center blog.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?