|
|
Recently we blogged about an unpatched Internet Explorer 7 exploit in the wild. With the vulnerability information made public, McAfee Avert Labs has noticed a spike in the number of active websites hosting this exploit. Lately we are seeing customized versions of the IE 7 exploit with varying degrees of obfuscation.
Malware authors have been coming up with innovative mechanisms to leverage this exploit to social engineer the not so tech-savvy internet users. One of the most prominent and unique techniques adopted by the malware authors involves a Microsoft word document being sent out to an unsuspecting user.
Upon opening the word document the embedded ActiveX control with the following classid is instantiated and executed.
This control stores configuration data for the policy setting Microsoft Scriptlet Component.
The control then makes a request to the webpage hosting the IE 7 exploit. The charm with this approach is that the exploit is downloaded and run without the knowledge or permission of the user. To the unsuspecting user it will just appear as yet another normal Doc file.
Microsoft has issued workarounds to block known IE 7 exploit attack vectors. We want to reiterate to all our readers to be vigilant and cautious while opening unknown Doc files or visiting dubious websites, while we continue to monitor the threat and protect our customers against the menace .
|
|
I have three unwanted programs to report to the Advert Lab, how do I completely get rid of them. Macaffee cannot remove these programs. Scarey because I just had my computer cleaned out and I don’t want any viruses in it. Thank You. That is why I purchase this protection.
>This control stores configuration data for the policy setting Microsoft Scriptlet Component.
What does this mean? This GUID appears to represent the scriptlet component itself.
The Scriptlet component itself is based on IE, so when you patch IE, it is patched. So if you install the IE patch, then Word is protected. So why both attacking Word instead of just attacking directly through IE?
MS has got to get rid of ActiveX! Clearly MS is incapable of making the technology safe (or they would have accomplished that after all of these years of trying)! And, whay in the heck does MS install (and worse…require) browsers on servers anyway? There should never be a browser installed on a server device!
Submit your own comments / message for this post