各位使用IE浏览器的童鞋请注意:
http://d1.it168.com/show/31441.html
据McAfee周五表示,导致
谷歌电子邮件系统被大陆神秘黑客攻破的IE
浏览器0-day漏洞最近已经被泄露到了网上。与此同时,德国联邦安全局也与同日发布了一则声明,提醒德国人民在IE推出安全补丁前暂时不要使用这款浏览器。 据McAfee的CTO George Kurtz在自己博客上的发帖显示:他们的研究人员在邮件列表中发现了有关的攻击代码,并确认称目前至少有一个网站已经公布了有关的漏洞攻击代码。他并表 示:"McAfee本周早些时候便已经发现了这样的攻击代码,并已经将这些代码提交给了
微软。不过这次泄露出来的攻击代码和我们提交的内容竟然完全一样。"
"这些代码被公布于众之后,类似的针对IE的攻击会很快在网上流传开来。"Kurtz写道:"不法分子可以利用这条公开的代码来攻击
Windows操作系统。而且不少流行的渗透测试工具中也已经加入了测试这个漏洞的功能。"
本周四微软就该漏洞发布了警告信息,并称他们正在修补这个漏洞。根据微软的警告,该漏洞可影响包括Windows7在内的各款流行Windows操作系统中的IE6/7/8程序。他们还宣称使用IE6的用户将是漏洞攻击者的首要攻击对象。
谷歌本周二曾对外宣布称发现有大陆黑客正利用这种漏洞对自己和其它几家美国公司发起攻击,另外谷歌同时还表示攻击的目标还包括多位私人用户的Gmail邮箱。
据谷歌表示,去年12月份中期他们便发现有此类攻击行为出现,尽管谷歌并没有明确指出这种攻击是否是在指使下进行的。但他们随后表示,由于遭受了这种肆 意攻击,因此他们准备退出中国市场。据熟知此事件内情的人士表示,这次针对谷歌的攻击所使用的攻击代码,与不久前针对几家美国公司所发起的攻击非常类似。
据透露,在这次攻击谷歌的事件中,有超过30家的美国硅谷企业开发的专利源代码被窃。Adobe公司已经确认称自己也是受害者之一,另据透露
雅虎,赛门铁克,Juniper,诺斯罗普格鲁曼(Northrop Grumman)以及陶氏化学公司(Dow Chemical)也是这次攻击的受害者。
McAfee表示,在分析了这些IE漏洞攻击代码之后,他们发现攻击者将这次攻击行动命名为“曙光行动”(Aurora),同时这次攻击所使用的手法可谓相当高明。
CNBeta编译
原文:cnet
http://jordanopensource.org/freeplanet/article/calls-stop-using-ie-after-googles-china-attacks
Calls to Stop Using IE after Google's China Attacks
After revelations that the large-scale cyber-attack on Google's infrastructure originating from China was caused by the weakness of the Internet Explorer (IE) web browser, Internet users have been asked to leave previous versions of the software.
"In our investigation we discovered that one of the malware samples involved in this broad attack exploits a new, not publicly known vulnerability in Microsoft Internet Explorer,"
said McAfee CTO George Kurtz. Microsoft confirmed that their web browser was behind the attack an issued a security advisory today that warned users of the critical and unpatched vulnerability. All the IE versions contain the security flaw, including IE6, IE7 and IE8 on Windows 2000, XP, Server 2003, Vista, Server 2008, Windows 7 and Server 2008 R2 are vulnerable to attack.
(Photo CC-BY Issa Mahasneh)
The German government
has officially advised its citizens to stop using all versions of Internet Explorer until Microsoft releases a security fix. According to the German government, users should switch to alternative browsers, as hackers will start to exploit the same vulnerability within days.
Other several IT experts and writers are advising users to leave Internet Explorer.
Dwight Silverman says "You, too, can be hacked like Google via IE. Microsoft is investigating the flaw and its implications, but while it does, there's no fix available. You are, for the moment, on your own. At this point, the best thing you can do is not use Internet Explorer, and switch to an alternative".
Daniel Indiviglio wrote "this story is another blow for Internet Explorer. The Google-China spat is big news right now, and this thrusts Microsoft in the center of it. As I mentioned a few months ago, IE is already beginning to give up small chunks of its market share each month to other browsers like Firefox and Chrome. Could this push firms affected by the Chinese attack to also begin exploring other browser alternatives? Will the rest of the Internet-using public take notice?".