Race on between hackers, Microsoft over IE zero-day

Game on as bad guys try to make public attack code reliable, say researchers

 Hackers are racing to build reliable exploits to use against a zero-day vulnerability in Internet Explorer (IE), putting pressure on Microsoft to push out a patch before attacks go public, researchers said today.

Yesterday, Microsoft first confirmed that new exploit code could compromise PCs running Internet Explorer 6 (IE6) and Internet Explorer 7 (IE7), then later in the day issued a security advisory that said Windows 2000, Windows XP and Windows Vista users were at risk.

Because the attack code had been publicly posted to a widely-read mailing list, researchers today said that the clock has started.

"This is clearly a critical vulnerability, and as bad as it gets," said Ben Greenbaum, a senior research manager with Symantec's security response team. "It is a race, yes, it certainly is," he added when asked whether hackers and Microsoft are pitted in a drag race.

"Definitely some kind of race," agreed Wolfgang Kandek, the chief technology officer at security company Qualys. "It's a matter of whether Microsoft can fix it first or attackers can get something that works reliably."

According to Kandek, variants of the original attack code have appeared on the Web. "So attackers are already working on [more reliable versions]," he said.

Greenbaum echoed Kandek's take that the original exploit was iffy. "By our tests, the published exploit code only works some of the time against some of the platforms," said Greenbaum. "[Hackers] will have to work on developing a more reliable exploit."

Their job won't be easy, but it can be done without too much difficulty, said Greenbaum, who characterized the creation of a working attack as somewhere between those two poles. "It won't be trivial, but it's not the Holy Grail of computing, either," he said.

In , Microsoft offered up several ways that users could protect their PCs until a patch is available, ranging from turning on the DEP (data execution prevention) security feature in IE6 and IE7, to boosting the browsers' security settings -- something that would block JavaScript. That move had been urged on users by several security companies Monday as a way to stymie any attack based on the original exploit, which relied on JavaScript to hijack a Windows PC.

But Kandek didn't think much of Microsoft's suggestions. "The mitigations are pretty complicated, and they're not very viable for the majority of users," he said. "For consumers, turning this on, turning that off makes the browser useless."

Another option, hinted Microsoft, is to switch to IE8, which doesn't contain the vulnerability. While that's something consumers can consider, and in fact should do, said Kandek, it's difficult or impossible for enterprise workers to swap out the browser supported by their companies. "I can switch to IE8 at home, and home users should do this," Kandek said, "but enterprise users typically cannot."

Microsoft will issue its next regularly-scheduled security updates in two weeks, on Dec. 8, but most researchers aren't expecting the company to pull a patch together that quickly. "I don't think that will happen," said Kandek. "IE is a pretty critical piece of software, and Microsoft will want to test [the patch] thoroughly."

Historically, Microsoft has taken a month or more to deliver a patch for a publicly-disclosed IE vulnerability. On the rare times when Microsoft has issued an "out-of-band" update -- one outside its normal second-Tuesday-of-each-month schedule -- it's done so because in-the-wild attacks were gaining momentum. As of yesterday, Microsoft said it had seen no evidence of attacks using the published exploit code, something Greenbaum said Symantec confirmed.

"But there's definitely activity on this," concluded Kandek. "Attackers are testing the waters to see how well different exploits work."