Nico Hines
Save 20% at Smythson

Internet Explorer is the default browser on most computers
Microsoft admitted today that a serious flaw in security has left the majority of the world’s internet users exposed to attacks from hackers hoping to steal personal data and passwords.
A loophole in Internet Explorer (IE), the default web browser on most computers, allows criminals to commandeer victims’ PCs by tricking them into visiting unsafe websites.
It is thought that two million computers have already been affected as Microsoft conceded that 1 in 500 internet users may have been exposed.
Computer users are advised by some security experts to switch to an alternative internet browser, such as Firefox or Google Chrome, to avoid the hackers who have so far corrupted an estimated 10,000 websites.
Microsoft said that it is considering the release of an emergency update to correct the flaw. The computing company claims that it has only detected attacks on Internet Explorer 7, the most common version of the browser, but gave warning that other versions are also potentially vulnerable.
The hack was initially devised by Chinese criminals, who have been stealing computer game passwords that can be sold on the black market.
However, Paul Ferguson, a security researcher for Trend Micro Inc, an anti-spyware provider, said that the security breach is so severe that it could be “adopted by more financially motivated criminals for more serious mayhem — that’s a big fear right now”.
Since the security flaw was reported on December 9, Microsoft said that there has been an exponential increase in attacks attempting to make use of the vulnerability. These opportunistic hackers who exploit known security breaches are called “zero-day” attackers.
These threats occur as hackers race against software makers to attack the affected programmes, such as IE, before the known problems are repaired.
“Zero days are unusual — and zero days in the world’s most popular browser on the world’s most popular operating system are really unusual,” said a Trend Micro spokesman. “The threat from it is only going to grow."
John Curran, a spokesman for Microsoft, said: “Right now it’s affecting about 0.2 per cent of users who may have come in touch with the vulnerability.
“It has the potential to move world wide rather quickly so it’s a significant issue and that’s why Microsoft is working diligently to get it resolved as quickly as possible.
“We are recommending four steps [see below] which would protect you from the vulnerabilities we know today but there could be variations to the vulnerabilities.
“Obviously the chance for this to be exploited is there.”
The company is telling users to employ a series of complicated workarounds to minimise the threat. It has been suggested that increasing the internet security zone level to high and disabling Ole32db.dll in the access control list could help protect a computer.
Some security experts, though, have advised IE users switch to another browser until an update is released. The next scheduled patch is not due until January 13 but it is not unusual for Microsoft to release an emergency patch.
Microsoft have struggled to build an appropriate patch thus far because the affected component is at the very core of the IE programme and any changes to the central code could cause a number of unexpected side-effects.
Microsoft’s advice for Internet Explorer users
1. Keep your anti-virus up-to-date. Microsoft has circulated the definitions of these vulnerabilities to all the major anti-virus providers.
2. Reset Internet Explorer to run in protected mode. This is the default mode in Windows Vista but not XP or the earlier versions.
3. Set zone security to high.
4. Ensure Windows is updated. You can do this manually through Windows updater or set it to automatic updates.
More complex and comprehensive approaches are listed on the Microsoft website .
Risk, resilience and embracing new technology
Industry sectors news at a glance. Interactive heatmap, video and podcast
The inside track on current trends in the charity, not for profit and social enterprise sectors
Read our exclusive 100 Years of Fleming and Bond interactive timeline, packed with original Times articles and reviews
Everything the Business Traveller needs to know to make a better trip
Shortcuts to help you find sections and articles
05/2005
£13,500
08/2008
£109,950
2005 / 55
£59,500
Great car insurance deals online
6 figures
Gatenby Sanderson, Office for Legal Complaints
West Midlands
C£100K+
Chronophage
Isle of Man
12-15 days a year, c £12K
Springboard
London
Six Figure
Rolls Royce
Midlands/Europe
From £89,950
Special Offers now available
like nothing on Earth!
.
NEW Las Vegas hotel for 2009 - Encore!
.
Amazing Far East Offers
Visit Malaysia from £755pp
Great travel insurance deals online
.
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths
News International associated websites: Globrix Property Search | Property Finder | Milkround
Copyright 2008 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.

Just use Firefox
Tim, IE Tabs purely runs IE in Firefox so that's not really a valid solution
Sam, Plymouth, UK
Just get IE tabs for Firefox and be done with it.
Tim, Oxford,
Sol,
I have bad news for you, the vulnerability exists al the way from IE ver 5 to 8 beta.
I would rather go at a snails pace than be vulnerable but that's your choice, Firefox or the swiss cheese of security IE.
Harry, Brisbane, Australia
Microsoft are issuing a security patch related to this problem. Release is planned for Weds 17th December (1pm EST)
Mark, Sussex, United Kingdom
I would say the ridiculous cost is why people buy Windows PCs rather than Macintosh. Sure, Macs are great - I use them at work - but they are way to expensive for home use when money is tight.
I've used Windows at home for 10 years and never had a security problem. Be sensible, be secure.
Darren Ward, Manchester, UK
a bit of info about how people are tricked into visiting web sites might have been useful
alex, lymington,
Maybe its time to try Firefox. I have been using it for five years and have rarely seen any spware/malware on my system as a result. Whilst using IE I would usually end up with 100's of them every month. I cannot believe people are still using IE.
Ahmet Arikan, London, UK
I use IE 8 and think it is very fast. I downloaded Chrome today and did a side by side test on my (very fast) laptop and Chrome was no quicker.
I like some of the new features in IE 8 and I recommend people upgrade to it. I think it's faster than firefox too. I use Opera on my phone though.
Sol, London, UK
Strictly speaking, "zero-day attacks" etc. refers to attacks made <i>on the same day</i> a vulnerability is announced or becomes more or less widely known.
D Horst, Ontario CA, US
Has anybody ever considered using Firefox or Opera? They're both great, with Firefox having the edge. Given google's hunger for collecting user's preferences for commercial reasons wouldn't recommend Google Chrome
Will, Oxford,
When IBM released the original MVS mainframe operating system they were so confident of its security that they offered a reward to anyone who could break it.. The difference between a corporation and a garage.
Bill Peter, Kuala Lumpur, Malaysia
The safest computer with Microsft Software on the net is the one that is still advertised. Once purchased, unpacked, booted and connected to the Inter-Web - in fact show it the phone socket - it's a major security flaw. 20+ years and Mirco$oft still cannot master the concepts of computer security.
Adrian Jones, Whitehill, GB
QUOTE "These threats occur as hackers race against software makers to attack the affected programmes, such as IE, before the known problems are repaired"
Honestly, read the article. Bob Schmidt has!
pat, Sheffield, UK
Microsoft still cant get it.. as said even after 23 years there are still major problems. Best advise is to get well away from their operating system and try Linux (ubuntu is a good example) you will never look back :o)
Malc, Colchester, UK
Don't switch to Chrome, it is barely out of beta testing! Firefox is a much safer choice and is immune to this particular problem.
Tony, Islington, London, UK
Yes as the Linux fan boys suggest move to Linux if you don't like games and applications because Linux hardly has anyway
John, Salford/Eccles, England
Sure, Firefox is safe as long as it's market share is so low. All the Firefox users trying to get IE users to switch could shoot themselves in the foot. If Firefox gets to be the dominant browser, the hackers will switch targets. Why target a product that can't get the majority of users?
Bob Schmidt, Memphis, USA
Microsoft must release the patch ahead of the monthly schedule to ensure the safety of their paying customers' . Only last month, a critical patch was released out-of-sequence because of the extreme risk to users
Fortunately there are alternative OS (Linux,Mac) that are far more secure. why use MS?
Faizal, London, UK
I find it incredible that people continue to buy Windows PCs and Microsoft software. They may be more stable, but they still present serious security issues. Even after 23 years of constant development.
E J Bull, Bristol, UK
Not all users of Internet Explorer are at risk. In fact, Linux-GNU users, who use IE to test website design, are safe. The risk is not merely in IE, but in the security "features" [read: flaws] of Windows.
So now is the perfect time to improve security by changing to Linux-GNU for safety.
Dan Fearnley, Oxford, UK
ii hope firefox3 is safe from such attacks- may we be told?
peter c, Devizes, Wessex