Microsoft on Wednesday issued a stopgap defense that protects Internet Explorer 9 (IE9) and IE10 against ongoing attacks until the company issues a patch, probably in three weeks.
An unpatched vulnerability in those two versions of Microsoft's browser has been used by two hacker groups to compromise Windows 7 and Windows 8 PCs running IE10, including machines of a French defense contractor and its suppliers, according to Israeli security company Seculert. The attacks may have started as early as Jan. 17.
"All affected customers should apply the easy, one-click 'Fix it' solution and follow the suggested mitigations outlined in the security advisory while an update is finalized," said Dustin Childs, group manager of Microsoft's Trustworthy Computing team, in an email Wednesday.
The security advisory Childs mentioned was also published Wednesday, as was a deeper dive into the vulnerability by Neil Sikka, an engineer with the Microsoft Security Response Center (MSRC), on Microsoft's Security Research & Defense blog.
It's unlikely that Microsoft will rush out an emergency patch for the IE vulnerability, said Andrew Storms, director of DevOps at San Francisco-based security firm CloudPassage.
"It would seem like it's still in the limited-attack category," said Storms in a Wednesday interview conducted using a messaging app. "So until that heats up, I don't see them rushing to push an out-of-band fix."
Microsoft has said it is working on a patch for the IE vulnerability, but offered nothing about a timetable. The next regularly-scheduled Patch Tuesday is three weeks away, on March 11.
Out-of-band updates -- described as such because they are issued outside the normal monthly schedule Microsoft maintains for security patches -- are rare: The last one Microsoft shipped was MS13-008, an emergency patch issued 13 months ago that plugged holes in IE6, IE7 and IE8 after those browsers had been exploited for about six weeks.
Until a patch is produced, Microsoft offered customers several options to protect themselves, including advice on configuring EMET 4.1 and running one of its "Fix it" automated tools to "shim" the DLL that contains the IE rendering engine.
EMET (Enhanced Mitigation Experience Toolkit) is a tool that manually enables anti-exploit technologies such as ASLR (address space layout randomization) and DEP (data execution prevention) for specific applications. Although it was originally designed for enterprise IT professionals, Microsoft has been touting its use as a security backstop for a wider audience of late.
(Ironically, simply installing EMET does the trick; the attacks seen so far abort if they detect the presence of the toolkit.)
But the Fix it route will be easiest for most people: Microsoft offered the tool on its support site, and customers need only click the icon on the left, the one marked "Enable MSHTML shim workaround." Microsoft has used the shim approach before when faced with unexpected attacks against IE, most recently last September.
Based on past practice, Microsoft's Fixit workaround probably uses the Application Compatibility Toolkit to modify the core library of IE -- a DLL (dynamic link library) named "Mshtml.dll" that contains the browser's rendering engine -- in memory each time IE runs. The shim does not quash the bug, but instead makes the browser immune to the attacks Microsoft has seen in the wild so far.
Users can also ditch IE for an alternate browser such as Google's Chrome or Mozilla's Firefox to stay safe until Microsoft comes up with a permanent fix, or if they're able, upgrade to IE11, which does not contain the bug. Windows 7, Windows 8 and Windows 8.1 users can run IE11, but those still stuck on Windows Vista cannot, because the 2007 operating system maxed out at IE9, one of the two versions vulnerable to attack.
According to Web measurement company Net Applications, about a third of all those people using IE are running either IE9 or IE10; approximately 16%, or one in every six IE users, run IE10, the version that has been targeted by cyber criminals.
Storms was mystified by some aspects of the vulnerability, particularly Microsoft's contention that, "We are not aware of any elevation of privilege or sandbox escape vulnerability being used to 'break out' of the Internet Explorer Protected Mode sandbox."
Protected Mode is Microsoft's label for the IE "sandbox," a technology to isolate the browser from the rest of the system so that if a successful exploit does hack the browser, the attack code should not be able plant malware on the PC. Protected Mode has been a feature of IE since IE7, which debuted in 2006.
"Even after the exploit gains code execution, it still needs a non-trivial element to result in a persistent compromise of the computer," Microsoft's Sikka wrote on the Security Defense & Research blog.
If a sandbox escape was not part of the exploit, Storms and others wondered how the attackers had managed to plant malware on the compromised machines. When asked what that meant, Storms replied, "It means there is something they aren't telling us."
Chaouki Bekrar, CEO of French vulnerability research lab and zero-day seller Vupen, had wondered much the same last week. "Usual question about yesterday's CVE-2014-0322 in the wild. How can it install EXE without IE sandbox bypass, any bypass there?" Bekrar asked in a Feb. 14 tweet directed at FireEye.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.
See more by Gregg Keizer on Computerworld.com.
Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.