Internet Explorer Flaw Generates Google Nation-State Attack Message
Microsoft issued a patch to address the vulnerability in IE, but the flaw triggering the warning message was not addressed.
Although the package of fixes includes a patch to address the vulnerability in IE, the flaw triggering the warning message was not addressed in the package.
"The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer," Microsoft explained in an advisory.
In order for a hacker to exploit the vulnerability, an IE user needs to land on an infected webpage. To steer traffic to such pages, cybercriminals will typically use phishing e-mails or instant messages containing links to the infected locations.
Until Microsoft patches the vulnerability, the company is offering a temporary solution that can be downloaded from its Technet website.
According to cybersecurity software maker Trend Micro, the vulnerability has prompted Google to issue warnings to some of its Gmail users. "Google is flagging attempts to exploit this vulnerability by noting 'Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer,'" it said in an e-mail to PCWorld.
"Reports show that this vulnerability has been used to compromise Gmail accounts," it added.
A number of Gmail users have reported on Twitter that they received the nation-state warning, but those tweets date back to days before the Microsoft advisory. Therefore, there's no way to know if they were triggered by the vulnerability or some other attack on Gmail users.
Google added the nation-state warning earlier this month. The warning doesn't mean that a Gmail account has been compromised, only that Google has detected that an account is under attack. Google declined to release details about how it knows one of its Gmail accounts is under attack.
The vulnerability in IE that allows the drive-by attacks is located in Microsoft XML Core Services. Microsoft XML Core Services provides a set of W3C compliant XML APIs that allows users to use Jscript, VBScript and Microsoft development tools to develop XML 1.0 standard applications, Trend Micro explained in a blog.
Using the vulnerability, it said, an attacker can craft a website to host a malicious webpage invoking affected MSXML APIs, which in turn accesses a COM object in memory that has not been initialized. The vulnerability is exploited when a user opens these crafted pages using IE.
While the buzz around big data analysis is at a peak, there is less discussion about how to get the necessary data into the systems in the first place, which can involve the cumbersome task of setting up and maintaining a number of data processing pipelines.
Next-generation endpoint protection vendor SentinelOne has received the same certification that many traditional antivirus platforms seek, meaning it can be considered suitable for meeting certain requirements of industry and governmental regulations.
Smartphone sales increased substantially in the second quarter of 2015, but the rate of growth continued to slow, fueling concerns that the market has started to become saturated, according to a study released today by Juniper Research.
Attackers could exploit a new vulnerability in BIND, the most popular Domain Name System (DNS) server software, to disrupt the Internet for many users.