Hackers attacking Internet Explorer vulnerability

Hackers are attacking consumers with an exploit of Internet Explorer (IE) that was allegedly used last month by the Chinese to break into Google's corporate network, a security company said.

That news came on the heels of warnings by the information security agencies of the French and German governments, which recommended that IE users switch to an alternate browser, such as Firefox, Chrome, Safari or Opera, until Microsoft fixes the flaw.

In an alert Websense said it identified "limited public use" of the unpatched IE vulnerability in drive-by attacks against users who strayed onto malicious websites. The site Websense cited in its warned has since been yanked from its hosting server.

According to Websense, the attack code it spotted is the same as the exploit that went public last week. That code was quickly turned into an exploit module for Metasploit, the open source penetration testing framework, by HD Moore, the creator of Metasploit and chief security officer for security company Rapid7.

Microsoft, however, continued to downplay the threat. In a post to the Microsoft Security Research Center (MSRC) blog, George Stathakopoulos, general manager of the Trustworthy Computing Security group, repeated earlier claims by the company that it had only seen a "very limited number of targeted attacks against a small subset of corporations."

Last week, Germany's Federal Office for Information Security, known by its German initials of BSI, and France's CERTA each issued advisories about the IE vulnerability.

Both BIS and CERTA called for users to ditch IE. "Pending a patch from the publisher, CERT recommends using an alternative browser," a translation of the French advisory stated.

A spokesman for Opera Software claimed that the download rate in Germany for its browser doubled over the weekend, and attributed the jump to the BIS warning.

For its part, Microsoft said it was hard at work on a fix, but did not commit to updating IE before the next regularly scheduled Patch Tuesday. "We have teams working around the clock worldwide to develop a security update," said Stathakopoulos, whose name on the MSRC blog entry is one sign Microsoft takes the vulnerability situation seriously. Stathakopoulos rarely posts on the MSRC blog.

The IE vulnerability has gained more attention than most browser zero-day bugs because it has been linked to the attacks that broke into some of the firms targeted in a widespread campaign that compromised Google's and Adobe's corporate networks. McAfee was the first to reveal that the attacks against Google had been conducted using exploits of the IE vulnerability.

Microsoft last week acknowledged that the flaw had been used to hack Google's network and others.