Google Issues Microsoft IE Warning

Activists using Microsoft Internet Explorer to access Google services are being targeted through an MHTML vulnerability.

(click image for larger view)
Slideshow: Top Features Absent From Windows 7
Google on Friday took the unusual step of issuing a security warning to users of Microsoft Internet Explorer. The company said that it has seen a significant number of targeted and apparently politically-motivated attacks directed at those accessing services at Google and at an unspecified popular social networking through Internet Explorer.
We believe activists may have been a specific target, Googles security team said in
a blog post
.
Google declined to elaborate on which activists have been targeted or where the attacks have been coming from.
Early last year, Google
reported
that it had been targeted by a sophisticated cyber attack from China and that the Gmail accounts of human rights activists had been a secondary target. The Gmail accounts of Vietnamese activists
were also targeted
last year.
Google has since introduced additional security for Gmail, including a
Last account activity
link and
two-factor authentication
.
The recent attacks attempt to utilize an MHTML flaw affecting all versions of Windows that
Microsoft acknowledged in January
.
MHTML is a container format that combines several documents into a single file using MIME encapsulation. The way MHTML is parsed is insufficiently robust, according to Google security research Michael Zalewski. This allows an attacker to use MHTML files to conduct server-side cross-site scripting attacks (XSS).
Zalewski says the vulnerability appears to have been around since 2004 and has been independently rediscovered several times since. In 2006, the vendor [Microsoft] reportedly acknowledged the behavior as by design; but in 2007, partial mitigations against the attack were rolled out as a part of MS07-034 (CVE-2007-2225), he wrote in
a blog post
. Unfortunately, these mitigations did not extend to a slightly modified attack published in the
January 2011 post
to the full-disclosure@ mailing list.
Googles security team sees attempts to exploit this vulnerability as noteworthy because the attacks show a high level of sophistication. To date, similar attacks focused on directly compromising users systems, as opposed to leveraging vulnerabilities to interact with Web services, the researchers wrote.
Googles security team says theyre working with Microsoft to develop a permanent fix. Until then, Zalewski and Microsoft are recommending that vulnerable users run a
Microsoft Fix It script
as a workaround.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Issues Microsoft IE Warning