Welcome to RCF - WHF

Nightrider · Sep 25, 2004

Microsoft's browser flaw exposed Google to hackers

SAN FRANCISCO (AP) - Microsoft says a security flaw in its Internet Explorer browser played a role in the recent computer attacks against Google and at least 20 other companies.

In a Thursday alert confirming the weakness, Microsoft said the security hole can be closed by setting browser's Internet security zone to "high." The world's largest software maker may also issue an update to fix the problem.

Microsoft pinpointed the trouble spot after Google announced earlier this week that hackers in China had pried into the e-mail accounts of human rights activists opposing the Chinese government's policies.

The attack outraged Google. It plans to leave China unless the government backs off rules requiring Google's Chinese search engine to censor some results.

munky2

fishead · Feb 09, 2005

Google runs Microsoft's IE, attacks show

....................

Thursday, Microsoft acknowledged that the IE exploit had been used in the attacks against Google and other major corporations. "We have determined that Internet Explorer was one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks," said Mike Reavey, director of Microsoft's Security Response Center (MSRC).

In fact, the malware that Microsoft and others researchers have examined was designed to exploit IE6, the eight-year-old browser that's most often used with Windows XP.

......................

Sheri McLeish, a Forrester analyst who covers browsers, wasn't surprised by the fact that Google workers run IE, even the aged IE6. "I don't have first-hand knowledge of why Google is using IE6, but what's under the hood at enterprises isn't always best practices," McLeish said. "There are likely business reasons why Google runs IE, because if they were easily able to upgrade [to IE8], they would."

Microsoft said, and independent researchers confirmed, that the exploits which struck Google would be largely deflected by IE7 and IE8, particularly the latter because it enables DEP (data execution prevention) by default.

"What these attacks point to is the fact that a lot of companies are running IE6," McLeish said. "Microsoft wants to kill IE6, a lot of companies want to kill it. But they can't."

.................

As McLeish said, Microsoft has urged customers to upgrade from IE6 to newer editions of its browser. It kicked off a campaign last August when Microsoft's general manager for IE said, "Friends don't let friend use IE6." The efforts haven't been entirely successful.....

http://www.computerworld.com/s/article/9145238/Google_runs_Microsoft_s _IE_attacks_show?taxonomyId=82