Microsoft IE bug leaves users vulnerable to phishing

Summary:Microsoft is developing a patch for a flaw in IE that could leave users open to phishing scams and other security threats

The US Computer Emergency Readiness Team (US-CERT), the net security watchdog, released a security alert on Friday warning of a flaw in Microsoft's Internet Explorer which allows attackers to run programs on a user's computer.

The flaw is in IE's cross-domain security model, which keeps frame content from different sources separate. This means that attackers could run programs and view files using the privileges of the user running IE.

Graham Cluley, senior technology consultant at Sophos, said on Monday that there are no reports so far of viruses or hackers exploiting this vulnerability; however, home users and businesses should be careful while "Microsoft feverishly puts the fix together".

"The flaw is not banking-specific," Cluley said, however, phishers could exploit the flaw to run a key logger, capturing Internet-banking passwords typed on the computer's keyboard. Key loggers can be installed on the computer by worms or Trojans, Cluley warned.

This is more difficult to avoid than the standard phishing attack that involves users entering their details into a fraudulent Web site, having been directed there by a spoofed email.

US-CERT advises that users disable Active scripting and ActiveX controls, maintain antivirus software and do not click on unsolicited links.

A spokesperson for Microsoft on Monday said that the company is currently investigating this bug and will put out a patch as soon as possible. Meanwhile they have updated their advice on how users can "Help ward off hackers and attackers".

Topics: Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.