New IE flaw has faster payload

Hackers now are employing new software to more quickly exploit a highly critical Internet Explorer zero-day vulnerability.

The software – posted to the website – is based on the createTextRange() flaw, disclosed March 22, which allows malicious attackers to execute code and use the PC as a bot to execute DDos attacks, media outlets reported Monday.

Initial versions of the malware worked slowly, giving users a chance to turn off their systems before the payload was unleashed. But the new software moves much quicker to compromise a system and employs features that are not detected by some anti-virus software.

Microsoft has yet to patch the vulnerability, but at least two vendors – eEye Digital Security and Determina – have issued fixes.

Mike Reavey, security program manager at Microsoft, said last week that the Redmond, Wash.-based computing giant is not seeing an increased spread of attacks and has been active in eliminating malicious websites that are exploiting the vulnerability.

"But attacks are still occurring, so we certainly still recommend up-to-date (anti-virus) software and our safe browsing guidance while we work on the update...," Reavey said on the Microsoft Security Response Center blog.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.