German Cybersecurity Agency Encourages Users to Ditch IE
'Too early to panic,' says security pro of German suggestion to switch browsers until Microsoft patches IE zero-day.
Germany's cybersecurity agency urged users to drop Internet Explorer (IE) and switch to a rival, like Chrome or Firefox, until Microsoft patches a new critical bug in its browser.
In an alert released Monday, Germany's Federal Office for Information Security, known by its German initials of BSI for "Bundesamt fuer Sicherheit in der Informationstechnik," noted that the unpatched vulnerability is already being exploited by hackers, and that "the attack code is freely available on the Internet."
BSI then advised users to stop running IE for now.
"The BSI recommends all users of Internet Explorer use an alternative browser ... until [Microsoft] has released a security update," the watchdog agency said.
"I think it's a bit too early to panic," said Andrew Storms, director of security operations at nCircle Security, when asked to comment on BSI's advice. "Granted, if the attacks escalate and the patch takes too long [to arrive] for comfort, then making the switch to another browser, at least temporarily, is a simple way to mitigate the threat."
According to Microsoft, IE6, IE7, IE8 and IE9 running on Windows XP, Vista and Windows 7 all contain the remote code execution vulnerability. IE10, the browser bundled with Windows 8, is free of the bug, however.
In a security advisory released late Monday, Microsoft offered customers several temporary workarounds to protect IE against attacks now circulating. One of the workarounds, said Microsoft, is to deploy EMET 3.0 (Exploit Mitigation Experience Toolkit), a utility unsuitable for most consumers.
Microsoft has promised to patch the vulnerability, but has declined to set a timetable. Some security experts believe the company is hustling to craft and test a so-called "out-of-band," or emergency, update that will be delivered before Oct. 9, the next regularly-scheduled Patch Tuesday.
Hackers have been exploiting the bug for an unknown length of time.
Other national computer security agencies, including US-CERT (United States Computer Emergency Readiness Team) and France's CERTA (Centre d'Expertise Gouvernemental de Reponse et de Traitement des Attaques informatiques), did not ape BSI's advice.
BSI has been quick to pull the trigger on browser-switching advice in the past.
In January 2010, BSI and several other countries' security organizations urged users to dump IE and run a rival while Microsoft worked on a patch.
The underlying IE vulnerability in that incident had been exploited by hackers to break into the corporate network of Google and other major Western companies. Google alleged that the attacks were launched by Chinese attackers.
Some security professionals, however, have suggested the same browser switch that BSI counseled. HD Moore, chief security officer at Rapid7, and the creator of the Metasploit penetration testing toolkit, advocated that strategy on Monday.
A new wave citizen developers is driving an explosion in enterprise app development with the help of software that requires little to no coding.
The attack that planted malware on Target's point of sale (POS) terminals in November's huge data breach used inside knowledge of the network rather than a vulnerability in its retail software, McAfee has said in its latest quarterly analysis.
University researchers have developed a technique that governments and Internet service providers could use to bypass secured Internet connections and gather valuable personal information.
For this month's "Patch Tuesday" round of bug fixes, Microsoft has focused on correcting multiple vulnerabilities in Internet Explorer (IE), including one that is already being used in targeted attacks.