IE zero day exploit loose

[PrntRhd]

Microsoft is investigating if a IE flaw allowed recent Adobe and Google hacks:
http://www.microsoft.com/technet/security/advisory/979352.mspx

more:
http://www.wired.com/threatlevel/2010/01/hack-of-adob
http://arstechnica.com/microsoft/news/2010/01/microsoft-warns-of-ie-security-flaw-used-in-google-attacks.ars
While Microsoft says it is only aware of limited, active attacks attempting to use this vulnerability in IE6, and has not seen attacks against other versions of IE, the vulnerability is not limited to version 6, according to the security advisory. Internet Explorer 5.01 on Windows 2000 SP4 is not affected, but IE6 on Windows 2000 SP4, as well as IE6, IE7 and IE8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are all affected.

[Cuc Tu]

This is News? lol

[PrntRhd]

Steve Balmer's nose grows longer every time MS assures us IE is safer than other browsers?
;)
IE6, IE7 and IE8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are all affected.

[PrntRhd]

Microsoft has updated their advisories and declared IE 8 is not affected.

[Paul Komski]

The German governement is obviously not impressed.

http://mashable.com/2010/01/15/german-government-stop-using-internet-explorer/

[Cuc Tu]

I wonder why the boys at Google weren't using Chrome?

[Paul Komski]

I wonder why the boys at Google weren't using Chrome?

From: http://www.wired.com/threatlevel/2010/01/hack-of-adob
Google announced Tuesday that it had been the target of a “highly sophisticated” and coordinated hack attack against its corporate network. It said the hackers had stolen intellectual property and sought access to the Gmail accounts of human rights activists. The attack had originated from China, the company said.

Minutes later, Adobe acknowledged in a blog post that it discovered Jan. 2 that it also had been the target of a “sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies.”

Neither Google nor Adobe provided details about how the hacks occurred.

Using or not using Chrome would appear to have little to do with how the hacking was organised. We are not told of the details.

[Cuc Tu]

yes, but the door is a-la-Microsoft.

Wouldn't have Chrome shown them a wall? It is, after all, about an IE exploit, no?

[Paul Komski]

There are two possibly related issues. One is the hacking of Gmail accounts etc that compromised Chinese civil rights activists etc but the details of which have not been made public. Such hacking probably involved grabbing the passwords from compromised machines at the homes of the targeted people. Whoever did the hacking probably used IE in order to grab the details but whatever browser or other approach was used was outside of Google or anyone else's control.

[jlreich]

Don't forget that IE is integrated into the OS. Even if it isn't actively being used as a browser it is still a vulnerability. ;)

[Cuc Tu]

No worries, Sylvester has the solution...

[PrntRhd]

Actually the reporters had their computers compromised by malware which picked off the passwords they used for access to the Google webmail accounts they were using to communicate with the Chinese dissidents. (Like Paul Komski theorized.)

Microsoft will patch the flaw tomorrow but insists only IE6 actually was compromised.
http://arstechnica.com/microsoft/news/2010/01/ie-flaw-used-in-chinese-attacks-on-google-patched-tomorrow.ars