We use your sign-up to provide content in ways you’ve consented to and to improve our understanding of you. This may include adverts from us and 3rd parties based on our understanding. You can unsubscribe at any time. More info
Microsoft has revealed a new zero-day vulnerability that impacts its ageing Internet Explorer 11 web browser. The flaw is currently being exploited by hackers, who are targeting people on Windows 10 machines. The vulnerability could allow bad actors to run code remotely – allowing them to gain complete control of a victim’s device.
As it stands, there is currently no patch available to fix the flaw.
It’s hoped that Microsoft will have a solution to the worrying flaw ready for its next Patch Tuesday release – a monthly security update rolled out to all Windows 10 users. Until then, there are a few options.
Firstly, seeing as the zero day impacts Internet Explorer 11 those using the browser can merely upgrade to Google Chrome or Microsoft Edge. If anyone impacted opts against this route then they’ll just be delaying the inevitable as Internet Explorer 11 (IE 11) has been on the way out for some time.
Google Chrome explain how users can view extension data
Last year, Microsoft Teams stopped working on IE11, as did over 1,000 popular websites like Instagram and Twitter. While this year remaining Office 365 apps have stopped working on Internet Explorer, and next year the browser is reaching its end of service entirely.
So even if you decide to stick with the veteran browser for now you’ll have no choice but to make the switch further down the line.
There are also a number of other options to help keep you safe from this ongoing threat. The Internet Explorer zero day vulnerability can be taken advantage of using specially crafted Office documents.
So until a patch addressing the flaw is released it’s best to avoid opening Office documents from any untrusted sources.
Microsoft has said that there are a number of mitigations to this threat.
This includes using default settings to ensure documents open in Protected View, and also preventing ActiveX controls from running in Internet Explorer. But even with these mitigations security experts have warned there are ways hackers can work round this.
This was revealed by well-known researcher Kevin Beaumont who, after looking at an attack sample, tweeted: “For bonus points I just modified it to not need a new ActiveX control, which beats the MS work around. Took about a minute.”
According to TrendMicro, the ultimate payload of this attack is to deliver the Cobalt Strike beacon. This would give a threat actor remote access to a victim’s device.
Source: Read Full Article