Did Google use Internet Explorer?

By Victor Ng | Jan 19, 2010

0 comments

Facebook

LinkedIn

Digg

Microsoft has acknowledged that the IE exploit had been used in the attacks against Google and other major corporations. "We have determined that Internet Explorer was one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks," said Mike Reavey, director of Microsoft's Security Response Center (MSRC).

However, Reavey downplayed the threat to average Windows users. "Microsoft has not seen widespread customer impact, rather only targeted and limited attacks exploiting IE6 at this time," he said.

It seems the malware that Microsoft and other researchers have examined was designed to exploit IE6, the eight-year-old browser that's most often used with Windows XP.

But, in response to McAfee’s claim  that the vulnerability in Internet Explorer played an important role in the recent attack against Google China, Imperva CTO Amichai Shulman cast doubt over the assertion.

While it's true that Microsoft issued a security advisory today, as McAfee noted when it reported the IE bug had been exploited by hackers who had attacked computer networks of nearly three dozen major companies between mid-December 2009 and Jan. 4, 2010, many industry watchers are questioning why Google wasn't using its own Chrome web browser instead. 

The advisory warned users of a critical and unpatched vulnerability in IE, and acknowledged that it had been used to hack several companies' networks.

“First, why are Google employees using IE and not Google’s own browser, Chrome? This doesn’t make sense,” explained Shulman. “Second, to execute an attack this sophisticated, it likely occurred as a result of spear phishing on Google employees to gain access to Google users’ credentials. A hacker would have to jump through many hoops inside an internal network. This requires network -- not browser -- vulnerabilities so that the attacker can communicate with malware inside Google’s internal network.”

He added: “Unfortunately, blaming Microsoft is all too easy and it’s leading to a panic. France and Germany are now recommending that its citizens not use Internet Explorer given its role in the recent Google hacking incident,” he said, citing today’s decision by leading European governments.

0 comments

Facebook

LinkedIn

Digg