Viruses/Worms News

Cybercriminals attack IE vulnerabilities

Wednesday, February 18, 2009

An IE exploit has been found in the wild that takes advantage of one of the two fixed vulnerabilities fixed by Microsoft last week in its monthly release of security patches.

The exploit exists thanks to a cybercriminal reverse engineering the security patch and creating malware that is sent via email, SCMagazineus.com reports.

A Word document containing code regarding the way IE7 handles types of content is sent in an email, according to the article. The code has an ActiveX object that accesses a website containing a downloader, which takes advantage of the vulnerability.

Users who open the attachment will install a backdoor trojan onto their machines, which is capable of communicating from a SSL encryption with a third-party server as it collects sensitive date from the user.

According to some security officials, the malware appears to have originated in China and has claimed an Asian journalist as a victim.
The timing of the attack, a week after security patches were released, may be an emerging trend among cybercriminals to bank on the fact users and organizations do not apply critical security patches in a timely manner.

Initially, this is how the Conficker, also known as Downadup, worm began.