Microsoft admits Internet Explorer at fault in Google China hacking

Microsoft says an Internet Explorer flaw may be responsible for allowing hackers to attack Google in China. The attack had previously been thought to be down to a problem with Adobe Acrobat Reader.

The firm’s security response chief Mike Reavey said, “Based upon our investigations, we have determined that Internet Explorer was one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks.”

Internet Explorer was fingered as the culprit by security firm McAfee, which discovered the flaw. The firm believes all versions of the browser, running on all versions of Windows, could be at risk, though the hackers had only targeted Internet Explorer 6.

According to McAfee, the attacks weren’t just limited to Google. George Kurtz, the firm’s chief technology officer, said they were part of a scheme dubbed Operation Aurora and involved attempts to steal or even modify company data without detection:

“Operation Aurora looks to be a coordinated attack on many high profile companies targeting their intellectual property… this malware enabled the attackers to quietly suck the crown jewels out of many companies while people were off enjoying their December holidays.

The flaw can only be exploited if the victim visits an infected website, for example through a bogus link in an e-mail. For individuals, that means common sense should be security enough. With companies, which appear to be the main target, it’s a numbers game: with hundreds or thousands of employees, it only takes one to get fooled for the trouble to start.

Microsoft has given its standard response to the security flaw: it’s investigating the issue and if appropriate will release a patch either as part of the next monthly update or as an “out-of-cycle” update if needed.

The problem involves Internet Explorer allowing remote code execution when an invalid pointer reference is followed. As a (somewhat strained) metaphor, imagine a festival organizer erecting signs to the temporary site and then mistakenly leaving one of the signs up after the event. A driver who follows that sign would then wind up confused, drop their concentration and be at greater risk of being carjacked. The situation is worse in reality as common sense would eventually allow the driver to figure out what had happened with the sign, a luxury not available to computers.

• 

• Internet Explorer patch coming tomorrow
• Microsoft concedes Vista and Internet Explorer security flaw
• British government backs Internet Explorer but version 6 under fire
• Google hijacks Internet Explorer with Chrome Frame
• France backs German advice: Avoid Internet Explorer