Microsoft update ignores spoofing hole

Microsoft update ignores spoofing hole

Summary: Microsoft has released its January batch of patches but has failed to fix an Internet Explorer 'phishing' vulnerability

SHARE:
TOPICS: Security
0

Microsoft released three patches on Tuesday to fix a number of security flaws, but surprised users by not releasing a patch for an Internet Explorer vulnerability that helps criminals steal users' identities and commit banking fraud.

The Internet Explorer vulnerability, which was first discovered in early December, allows the browser window to display an URL in the address tab while actually connecting to a different Web site altogether. On Monday, separate emails targeting Barclays and Lloyds TSB's online-banking customers attempted to exploit the flaw and steal customers' passwords.

However, Microsoft is not yet convinced that there is a serious problem and has so far refused to say when a fix will be released. A Microsoft spokesperson told ZDNet UK that the company is "aggressively investigating" the problem and will take "the appropriate action" on completion of its investigation. The company did admit that "it may be possible for an attacker to display misleading information" but denied the flaw was being actively exploited: "Microsoft is monitoring the situation closely but at this time has no indication of widespread usage of the vulnerability," the spokesperson said.

Microsoft also blames Web sites that publish details about the flaw without giving it enough time to fix the problem: "It is unfortunate for customers that this issue was not reported to Microsoft, following responsible disclosure practices," the spokesperson said.

In December, Openwares.org, an open-source software development Web site, posted a patch designed to fix the Internet Explorer vulnerability, but Microsoft and industry analysts advised against installing it in case it clashed with future updates.

The administrator of Openwares.org, who requested anonymity, said that the patch has been downloaded more than 125,000 times and he has received numerous emails from people thanking him, including a group of Earthlink users: "There was a phishing scam targeted at Earthlink subscribers and I have had about 20 emails from Earthlink users who almost got ripped-off; our patch helped them," he said.

Microsoft said that when it completes its investigation, the fix will be included in the next batch of patches. However, if Microsoft believes the problem requires urgent attention, a patch will be issued outside its monthly cycle.

Topic: Security

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

0 comments
Log in or register to start the discussion