Newest IE bug could be next Conficker

Critical IE bug is 'custom-made' for hackers, claims security expert; expect major attacks

The critical bug that Microsoft confirmed Monday but has yet to patch is a prime candidate for another Conficker-scale attack, a security researcher said.

"It's better than [the vulnerability used by] Conficker," Roger Thompson, chief research officer at AVG Technologies, said yesterday. "It exposes the whole world, and can be exploited through the firewall. That's better than Conficker, which mostly did its damage once it got inside a network."

[ Some experts believe the number of PCs infected by Conficker could be in the tens of millions. | For the full Test Center rundown on browser security, see InfoWorld's special report. | Learn how to secure your systems with Security Adviser newsletter. ]

Conficker, the worm that exploded into prominence last January when it infected millions of machines, exploited an already-patched bug in Windows that Microsoft had thought dire enough to fix outside its usual update schedule.

The worm hijacked a large number of PCs -- estimates ranged as high as 12 million at one point -- and then assembled them into a massive botnet able to spread malware, plant fake anti-virus software, or distribute huge amounts of spam.

"I have no doubt that the really bad guys are bustling to get this [new vulnerability] into their exploit toolkits," said Thompson. "For the Conficker people, this could be the next thing. They waited until they had a really good exploit, then combined that with some smart strategies. So I wouldn't be surprised if they picked up on this."

The vulnerability Thompson's worried about is in the Microsoft Video Controller ActiveX Library, or the msvidctl.dll file, an ActiveX control that can be accessed using Internet Explorer (IE). Although the bug has been used by hackers since at least June 9, it only made it into the public eye this week, when several security companies, including firms in both China and Denmark, reported that thousands of compromised sites were serving up exploits.

On Monday, Microsoft acknowledged the vulnerability in a security advisory, said it would produce a patch, and provided an automated tool to disable the ActiveX control by setting nearly three-dozen "kill bits" in the Windows registry.

"This is a good exploit with a big lump of infectable people," said Thompson.

One reason why the bug is an excellent choice for hackers is that it hasn't been patched. When Conficker first appeared, the flaw it exploited had already been patched by Microsoft. It turned out, however, that there were plenty of PCs that had not been updated with the fix.