Internet Explorer Security Scare


You may have seen, or heard, news coverage about a significant security problem with Windows Internet Explorer. Following Microsoft’s admission that Internet Explorer was used to hack Google the German Government warned against using Internet Explorer. Now France has issued a similar warning.

INTERNET EXPLORER SCARE
Internet Explorer is the web browsing software used by many to access the internet. If you use this browser, the current flaw allows exploiting hackers to access files on your computer, to log keystrokes made, and to redirect you to specific websites. However, the advice from AGUK is not to panic but be cautious. 

To take any such advantage of a compromised system, a hacker must get you to either visit a specific website, or install a browser add-on. Depending on your security settings, this add-on (unlike software browser add-ons known as ActiveX controls) can be installed without you knowing. It is also undetected by current anti-virus software.

AGUK’s Security Action Plan
If you do not know which type of browser you are using click here and visit our browser test page. If you are using Internet Explorer there are steps you can take to reduce the risk of falling victim to Internet Explorer’s browsing weakness.

(1) Alternative Browser
You could install and use an alternative web browser. AGUK recommends Google Chrome. This lightweight browser is faster than Internet Explorer and is growing in popularity. This would not necessitate the removal of Internet Explorer.

(2) Run Internet Explorer in Safe Mode with add-ons disabled
It is possible to run Internet Explorer with all add-ons disabled. This will help prevent your browser being susceptible to this latest attack. The simplest way to do this is by creating a shortcut on your desktop. Here’s how:

Close down all open programs and on your desktop right click on your mouse and select: [New > Shortcut]. Then in the box labelled "Type the location of the item” paste the following text exactly, including the quotes:

“%ProgramFiles%\Internet Explorer\iexplore.exe” –extoff

After you have done that click [Next] and then [Finish]. A new shortcut will now be on your desktop called iexplore.exe. When you use this shortcut you will see that Internet Explorer is launched with all add-ons and ActiveX controls disabled.  In this mode it is possible some websites will not display correctly, but this is the sacrifice you must pay until the security hole is closed by Microsoft.

(3) Enable High Security level in Internet Explorer
It is recommended you follow this process in conjunction with option 2 above.

Windows XP Users: Click Start > Run and type inetcpl.cpl then press Enter.

Windows Vista and Windows 7 Users: Click Start and in the search box type inetcpl.cpl then press Enter.

You should now see the Internet Properties window. Click on the Security tab, select Internet from the zones and then move the slider to High as per the image below. Make sure you click OK once you have changed these settings.

If you have any questions or concerns about this issue please let us know in the comments.

 

Posted by

Comments (8)

Jan 19, 2010
Tim Acheson said...
Clearly, Google is to blame for this latest security incident in which the privacy and security of Google users was seriously compromised. IE6 is very old and outdated software. Google and its employees should not be using old software like IE6 without understanding the risk. Google employees should upgrade to IE8 immediately.

Every company bears responsibility for keeping their software up to date. Domestic users bear some responsibility for security on their home computers, too. Ignorance, negligence or complacency can lead to undesirable incidents in any scenario. It's common-sense. This lesson extends beyond the web browser and includes all software used within an organisation. (E.g. An old version of Flash could be a security risk in the any version of any web browser.)

Any suggestion that other browsers or indeed any software is somehow "safe" is pure meaningless rhetoric. IE provides web access on over 90% of enterprise desktops. Obviously more usage means it's more likely to be involved in incidents.

Users and IT departments must keep their software up to date. (Data Execution Protection is enabled in IE8 by default.) Within any web browser there are also other factors, e.g. the ubiquitous Flash plug-in in which countless security vulnerabilities have been identified in numerous versions. When a problem is detected in software, an update is released, which is why users much keep up to date.

IE8 is the most secure web browser:
http://www.timacheson.com/Blog/2009/aug/ie8_is_the_most_secure_web_browser

But the IE6 angle is all very convenient for Google, who have developed their own rival web browser to compete directly with Internet Explorer. Google fans are successfully portraying Google as the Hero in this story. For them, the theme is Google standing up to China, while they try to deflect blame to Microsoft for releasing IE6 a decade ago. In reality, this is 2010 and no responsible or knowledgeable web user should be using IE6.

Jan 19, 2010
Andy Gambles said...
@timacheson Thank you for the comment. I agree that any software or browser can present a security threat and that keeping up to date is extremely important.

IE6 from both a security and web standards point of view is really an EOL product. I have seen articles bashing Microsoft for taking this opportunity to push the upgrade to Windows 7 option. In all honesty this is probably the right thing to do, encourage upgrading not bashing Microsoft, as it will help expedite the end of IE6.

Jan 19, 2010
Tim Acheson said...
Yes, nobody should be using IE6 anymore! They should have upgraded to IE8 long ago.

Yet, I'm aware of several major corporations where the common desktop environment has only recently upgraded from IE6. Continued usage of IE6 surely reflects an extremely weak attitude to security within organisation (including Google).

Jan 20, 2010
Tim Acheson said...
Many of the people posting anti-IE/anti-MS comments here and elsewhere seem to be under the impression that other web browsers are somehow holy or sacred. All web browsers have security issues, not just IE; but more people jump on the bandwagon when it's IE.

NEWSFLASH: ALL WEB BROWSERS HAVE SECURITY ISSUES, IT'S NOT JUST IE6.

"There is a critical JavaScript vulnerability in the Firefox 3.5 Web browser, Mozilla has warned."
http://news.cnet.com/8301-1009_3-10287172-83.html

"For the second time in two weeks, Google has shipped a new version of its Chrome browser to fix a pair of serious security vulnerabilities."
http://blogs.zdnet.com/security/?p=3324

There are numerous other examples, of course, for those who care to check the facts.

Jan 20, 2010
Andy Gambles said...
@timacheson Can you point out the anti-IE/anti-MS comments posted here?
Jan 20, 2010
Tim Acheson said...
Clarification: by here I meant "the blogosphere" I don't think there's an option to edit a comment here, otherwise I'd fix that ambiguity.
Jan 21, 2010
Andy Gambles said...
Microsoft have released a patch for this vulnerability - http://bit.ly/7EfcGX
Jan 22, 2010
Andy Gambles said...
AGUK blog post about Internet Explorer Security Update - http://bit.ly/7o1Pgq

Leave a comment...