The panic over this month’s wave of targeted, zero-day attacks against Google, Adobe, and other companies is over. Microsoft has released a security update for Internet Explorer that patches the underlying vulnerabilities, and everyone can breathe a sigh of relief.
But what does this episode say about Internet Explorer? I’ve seen several pundits argue that Internet Explorer is inherently unsafe. I think they’re overreacting. Yes, there is a case to be made for using a different browser, especially one with a lower market share that is targeted less frequently than Internet Explorer. (And if you’re too impatient to read this entire post, then skip to the last page for that discussion.) But it’s also true that switching browsers is a small part of a comprehensive, defense-in-depth security strategy.
One thing’s for certain: Changing browsers isn’t a magic bullet, and it might not have made a difference in this case, as I explain in this post.
First things first: How do I protect myself from becoming a victim of this exploit?
Regardless of which version of Internet Explorer or Windows you’re using, you should install today’s Cumulative Security Update for Internet Explorer (described in KB978207 and Microsoft Security Bulletin MS10-002). This update should be delivered automatically via Windows Update or Windows Software Update Services.
You should also turn on Data Execution Prevention, a feature which prevents code execution from data pages in memory (technical details for the Windows XP family are here, for Windows Vista and 7 here). DEP is on by default in Internet Explorer 8. To enable DEP on Windows XP or Windows Vista with IE6 or IE7, use the Fix It tool on the MS10-002 advisory page.
So, exactly what happened in this case?
The public does not know the full details of what happened. Various reports and analysts have published conflicting reports with a lot of speculative analysis. A January 12 report by Verisign’s iDefense security outfit blamed the attacks on an Adobe PDF vulnerability. That report was retracted two days later, although many news stories based on that inaccurate report have not been corrected.
