Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo


Unsupported browser: Your browser does not meet modern web standards. See how it scores »

{ action.text }

Internet Explorer is the world’s most popular browser, but that doesn’t mean it’s impregnable–security experts have recently drawn attention to how attackers could exploit it to spy on users. Last month, a vulnerability in Internet Explorer was implicated in Chinese hackers’ attacks on Google. Microsoft quickly patched the flaw with a special security update, but not much later, Jorge Luis Alvarez Medina, a security consultant for Boston-based CORE Security Technologies, revealed a scheme that could let an attacker read any file on a user’s computer through Internet Explorer.

In a talk last week at Black Hat DC, a computer-security conference in Washington, DC, Medina outlined how he built a series of seemingly minor flaws into a much more serious attack. Usually, files stored on a user’s computer are treated differently from those intended to be accessible through the Internet. Medina’s attack blurs the line between the two types of files, allowing an attacker to access personal files over the Internet. During his talk, Medina demonstrated code that allowed him to upload files from a user’s computer.

To make the attack work, the Internet Explorer user has to click a link to a malicious Web page. Once the user navigates there, the attacker uses a variety of holes and features in Internet Explorer to gather information about the user’s computer. At the same time, the attacker sneaks some malicious code into the browser (websites are allowed to write some code into the browser, for example in the form of tracking files called “cookies”). The attacker uses what he’s learned to direct the browser to open that malicious code as if it originated from the user’s computer. If he can convince the browser to run the code, then the attacker will have crossed the divide between the Internet and the user’s local machine.

Medina has been investigating this type of attack for some time–CORE Security issued an advisory on his first version of this attack in 2008. However, he says, Microsoft has responded by releasing patches that focus only on preventing the browser from actually running the malicious code–the fixes don’t stop the attacker from learning about the user’s computer, which could, potentially, lead to other attacks. Medina believes the attack could be stopped more effectively by closing down flaws at all points of the chain. “It makes no sense to think about this vector if none of the [string of exploits] are possible,” Medina says.

7 comments. Share your thoughts »

Credit: Technology Review

Tagged: Web, security, Microsoft, Black Hat, browsers, Internet Explorer

Reprints and Permissions | Send feedback to the editor

From the Archives


Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me