The U.S. Department of Homeland Security advised computer users to consider using alternatives to Microsoft Corp's Internet Explorer browser until the company fixes a security flaw that hackers have used to launch attacks.
The bug is the first high-profile security flaw to emerge since Microsoft stopped providing security updates for Windows XP earlier this month. That means PCs running the 13-year old operating system could remain unprotected against hackers seeking to exploit the newly uncovered flaw, even after Microsoft figures out how to defend against it.
The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
"We are currently unaware of a practical solution to this problem," Carnegie Mellon's Software Engineering Institute warned in a separate advisory, that US-CERT linked to in its warning.
Versions 6 to 11 of Internet Explorer dominate desktop browsing, accounting for 55 percent of the PC browser market, according to tech research firm NetMarketShare. Google Inc's Chrome and Mozilla's Firefox account for the majority of the rest of the traffic.
Microsoft disclosed on Saturday its plans to fix the bug in an advisory to its customers posted on its security website, which it said is present in Internet Explorer versions 6 to 11. Those versions dominate desktop browsing, accounting for 55 percent of the PC browser market, according to tech research firm NetMarketShare.
Cybersecurity software maker FireEye Inc said that a sophisticated group of hackers have been exploiting the bug in a campaign dubbed "Operation Clandestine Fox."
FireEye, whose Mandiant division helps companies respond to cyber attacks, declined to name specific victims or identify the group of hackers, saying that an investigation into the matter is still active.
"It's a campaign of targeted attacks seemingly against U.S.-based firms, currently tied to defense and financial sectors," said FireEye spokesman Vitor De Souza on Sunday. "It's unclear what the motives of this attack group are, at this point. It appears to be broad-spectrum intel gathering."
In addition to possibly switching to an alternative web browser, US-CERT advised businesses to consider using a free Microsoft security tool known as EMET, or the Enhanced Mitigation Experience Toolkit, to thwart potential attacks. Security experts say EMET is helpful in staving off attacks, but businesses are sometimes reluctant to use it because it can cause systems to crash due to incompatibility with some software programs.
FireEye and Microsoft have not provided much information about the security flaw or the approach that hackers could use to figure out how to exploit it, said Aviv Raff, chief technology officer of cybersecurity firm Seculert.
Yet other groups of hackers are now racing to learn more about it so they can launch similar attacks before Microsoft prepares a security update, Raff said.
"Microsoft should move fast," he said. "This will snowball."
Microsoft said in a statement to Reuters that it advises Windows XP users to upgrade to one of two most recently versions of its operating system, Windows 7 or 8.
Anda sedang membaca artikel tentang
Internet Explorer bug used by hackers to attack U.S. firms
Dengan url
http://belajarbisnismen.blogspot.com/2014/04/internet-explorer-bug-used-by-hackers.html
Anda boleh menyebar luaskannya atau mengcopy paste-nya
Internet Explorer bug used by hackers to attack U.S. firms
namun jangan lupa untuk meletakkan link
Internet Explorer bug used by hackers to attack U.S. firms
sebagai sumbernya
0 komentar:
Posting Komentar