Are you one of those people who are just so comfortable using the outdated Internet Explorer that you’re refusing to move on and use something updated like the Edge, Chrome, or Firefox? Here’s another reason why you need to retire that old horse to the glue factory.
A hacking group has released a new malware set to attack those using Windows with Internet Explorer once they open an Office file, according to researchers from Qihoo 360’s Core security unit. What can you do to protect yourself from this new malware?
Zero-Day Exploit
The hacking group is taking advantage of a zero-day exploit in Internet Explorer, known as a “double kill” vulnerability. It’s a previously unknown and unpatched exploit that uses the User Account Control bypass, as well as reflective DLL loading, fileless execution, and steganography.
The researchers report the hackers, an advanced persistent threat (APT) group, is using the IE vulnerability on a “global scale.” They get to the exploit through an Office document that is infected with the “double kill” vulnerability
To set off the malware, Windows users have to be using IE and choose to open the Office file. Both components need to be at play, as once they open the infected Office document, it launches a webpage in the background that sends the malware from a remote server.
The Fix
The researchers who discovered this malware and exploit have reported their findings to Microsoft and are suggesting a patch be created.
Microsoft told ZDnet, “Windows has a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection. Our standard policy is to provide remediation via our current Update Tuesday schedule.”
Okay, so that really isn’t that much of a fix so much as a suggestion for the environment you should be using with Windows. Make sure the software is updated and use a newer browser, but really, that advice holds true no matter what you’re doing online and what OS you’re using.
And certainly you shouldn’t open unknown files either. That’s just yet another mistake taking place that leads to allowing this malware to ruin things for you.
In Closing
While Microsoft seems noncommittal with regards to creating a patch for a browser they seem to have abandoned, if you don’t open unknown files, only uses the latest version of Windows, and don’t use IE, it sees you don’t need to worry about a “fix.”
If you’d like more information on how to protect yourself from malware, read these suggestions from our writers, such as using a third-party software to clear your PC of malware and whitelisting trusted websites, such as Make Tech Easier.
Were you hit with this malware, or do you know anyone else who was? Are you still using IE, or did you dump it off a long time ago? Let us know in the comments section below.
