Microsoft IE breached by new attacks

There is no question that Microsoft's Internet Explorer has become more secure over time. There's also no question that with roughly 69 percent of the global browser market, IE remains a meaty target.

It is therefore not surprising that IE is under attack, though perhaps the recent breach of fully-patched IE is surprising, as as The Register reports:

The attacks target a flaw in the way IE handles certain types of data that use the extensible markup language, or XML, format. The bug references already freed memory in the mshtml.dll file. According to IDG News, exploits work about one in three times, and only after a victim has visited a website that serves a malicious piece of javascript.

As usual, there is browser security and then there's "user of the browser security." I suspect that the former is pretty strong with IE, but the latter...? Well, if someone wants to foolishly visit suspect sites, perhaps they're getting what they deserve.

[MSSlayer]

There are plenty of legitimate sites, mainly those foolish enough to run some MS server, that are compromised and anyone who visits with IE gets blasted. Quite often the exploit requires no effort on the users part.

I think you meant to say: "Well, if someone wants to foolishly use IE, perhaps they're getting what they deserve."

That is closer to the truth.

[MSSlayer]

I should have also added: those foolish enough to allow PHP apps on their server along with the MS server caveat.

Gotta be fair to MS :)

In terms of security ineptness, the people behind PHP and many who use it, are easily Microsoft's equal.

[Eddie-c]

How many people, with a history in I.T., remember the constant flow of notices from CERT about disabling scripting as the internet grew ... "exploit alert.. exploit alert ... recommended action ... disable scripting". But of course now too many sites 'have to' give you that rich experience and will only work with scripting enabled instead of actually coding a site that can with with AND without it running. Oh hey, remember lynx anyone? ;)

[Ilgaz]

Dare to write that comment here, on this site with Javascript disabled? :)

[gcharlan]

You're wrong here, Matt

Legit sites like CNN, the US Postal Service, and several UK municipalities have been compromised.

http://www.infoworld.com/article/08/10/03/Researcher_finds_evidence_of_massive_Web_site_compromise_1.html

Can't really blame the end users any more :(

-Greg C

[Martin_Anon]

That last sentence was just amazingly self-righteous. I enjoy your writing and your articles and expect better from you. I usually expect you to apply a little more thinking to your ideas before publishing something like that.
As for the rest - great stuff!
Thanks.
Regards, Martin.