What you need to know about the Internet Explorer zero-day attacks

Microsoft has confirmed reports that a zero-day vulnerability in its Internet Explorer Web browser is being actively attacked in the wild. While Microsoft works diligently to crank out a patch, it’s important for businesses and consumers to understand the threat, and the steps that can be taken to avoid compromise while you wait.

Microsoft has published a security advisory acknowledging the threat. According to Microsoft, the zero-day exploit affects Internet Explorer 7, 8, 9. Internet Explorer 10 is not impacted, but it’s not completely safe because it remains vulnerable to flaws in the embedded Adobe Flash.

The Microsoft advisory includes some tips that can be used to defend against this threat pending a patch for the underlying flaw. Microsoft recommends that customers use the Enhanced Mitigation Experience Toolkit (EMET) to implement mitigations that can prevent the zero-day exploit from working. In addition, Microsoft advises customers to set the Internet and local intranet security zone in Internet Explorer to “High” to block ActiveX controls and Active Scripting from running, or at least configure it to prompt before executing.

Andrew Storms, director of security operations for nCircle, puts the threat in perspective. “If your systems are running IE, you are at risk, but don’t panic. The reality is it’s just one more zero-day and we’ve seen an awful lot of them come and go.”

However, Storms isn’t confident that business customers will appreciate the guidance from Microsoft. “If you set your Internet and local security zones to ‘High’ as recommended to block ActiveX controls and Active Scripting, there’s a very good chance necessary business applications will be adversely affected.”

The Metasploit exploit for the Internet Explorer zero-day relies on the presence of Java on the target system. That means that PCs without Java are safe against the Metasploit-based exploits, and that it might be a great time to reevaluate whether your PCs really need to run Java. If you don’t actually use Java, uninstall it.

Liam O Murchu, manager of operations for Symantec Security Response, adds some interesting trivia. “Another interesting point to note regarding this vulnerability is that the exploit was found on the same servers being used as part of the Nitro attacks. In August, Symantec observed that the cybercriminals behind this ongoing targeted attack campaign, which initially targeted companies in the chemical industry, had ramped up their efforts with several new techniques and a Java zero-day vulnerability.”

Essentially, if you can remove Java you should do so. Regardless of Java, though, businesses and consumers alike should always be vigilant about ActiveX controls or Active Scripting executing within the browser and take steps to guard against malicious code.

The next routine Patch Tuesday isn’t scheduled until October 9. It seems reasonable to assume Microsoft will release an out-of-band patch for this flaw before then.

Copyright (c) 2012 PCWorld Communications, Inc.