We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

What you need to know about the Internet Explorer zero-day attacks

Microsoft has confirmed reports that a zero-day vulnerability in its Internet Explorer Web browser is being actively attacked in the wild. While Microsoft works diligently to crank out a patch, it's important for businesses and consumers to understand the threat, and the steps that can be taken to avoid compromise while you wait.

Microsoft has published a security advisory acknowledging the threat. According to Microsoft, the zero-day exploit affects Internet Explorer 7, 8, 9. Internet Explorer 10 is not impacted, but it's not completely safe because it remains vulnerable to flaws in the embedded Adobe Flash.

The Microsoft advisory includes some tips that can be used to defend against this threat pending a patch for the underlying flaw. Microsoft recommends that customers use the Enhanced Mitigation Experience Toolkit (EMET) to implement mitigations that can prevent the zero-day exploit from working. In addition, Microsoft advises customers to set the Internet and local intranet security zone in Internet Explorer to "High" to block ActiveX controls and Active Scripting from running, or at least configure it to prompt before executing.

Andrew Storms, director of security operations for nCircle, puts the threat in perspective. "If your systems are running IE, you are at risk, but don't panic. The reality is it's just one more zero-day and we've seen an awful lot of them come and go."

However, Storms isn't confident that business customers will appreciate the guidance from Microsoft. "If you set your Internet and local security zones to 'High' as recommended to block ActiveX controls and Active Scripting, there's a very good chance necessary business applications will be adversely affected."

The Metasploit exploit for the Internet Explorer zero-day relies on the presence of Java on the target system. That means that PCs without Java are safe against the Metasploit-based exploits, and that it might be a great time to reevaluate whether your PCs really need to run Java. If you don't actually use Java, uninstall it.

Liam O Murchu, manager of operations for Symantec Security Response, adds some interesting trivia. "Another interesting point to note regarding this vulnerability is that the exploit was found on the same servers being used as part of the Nitro attacks. In August, Symantec observed that the cybercriminals behind this ongoing targeted attack campaign, which initially targeted companies in the chemical industry, had ramped up their efforts with several new techniques and a Java zero-day vulnerability."

Essentially, if you can remove Java you should do so. Regardless of Java, though, businesses and consumers alike should always be vigilant about ActiveX controls or Active Scripting executing within the browser and take steps to guard against malicious code.

The next routine Patch Tuesday isn't scheduled until October 9. It seems reasonable to assume Microsoft will release an out-of-band patch for this flaw before then.

IDG UK Sites

Apple promises developers better stability, performance for Swift

IDG UK Sites

5 things we hate about MWC: What it's like to be a journalist at a technology trade show

IDG UK Sites

Interview: Lauren Currie aims to help design students bridge skills gap

IDG UK Sites

12in Retina MacBook Air release date rumours: new MacBook Air to have fingerprint ID, could launch...