Legal Commentary

IE Considered Dangerous

By Professor University of Miami School of Law

Exploit in the Wild for New Internet Explorer Flaw — Krebs on Security

Less than 24 hours after Microsoft acknowledged the existence of an unpatched, critical flaw in all versions of its Internet Explorer Web browser, computer code that can be used to exploit the flaw has been posted online.

This was bound to happen, as dozens of researchers were poring over malicious code samples that exploited the flaw, which has generated more interest and buzz than perhaps any other vulnerability in recent memory. The reason? Anti-virus makers and security experts say this was the same flaw and exploit that was used in a series of sophisticated, targeted attacks against Google, Adobe and a slew of other major corporations, in what is being called a massive campaign by Chinese hacking groups to hoover up source code and other proprietary information from these companies.

…

… this is a browse-to-a-nasty-site-and-get-owned kind of vulnerability. As such, Internet users will be far more secure surfing the Web with an alternative browser (at least until Microsoft fixes this problem), such as Google Chrome, Mozilla Firefox, Opera, or Apple’s Safari for Windows.

No doubt there will be a patch soonish, but until then…and even after then for folks who don't patch religiously.

Incidentally, do we actually know all those other browsers are safe, or is it just that no exploits are in the wild yet?

Full post as published by Discourse.net on January 16, 2010 (boomark / email).