Microsoft have published a security advisory for a zero day attack being used against a targeted audience using Internet Explorer 6, 7, and 8. This atypically means corporate or business users still locked in to using these older browsers.
Home users running XP should be looking to use another browser as their primary method of browsing the web, and corporate security staff should review Microsofts recommendations to build a layered defence to protect staff.
Microsofts information on the vulnerability:
Microsoft Advisory 2794220:
General information and basic mitigation steps at:
Useful technical information at:
Here is some basic analysis from FireEye on the Council on Foreign Relations website that was compromised and hosting malicious content:
Thank you to Toby and another Reader for writing in with this.
Chris Mohan --- Internet Storm Center Handler on Duty
Join Ashley Deuble for MGT 414: SANS +S Training Program for the CISSP Certification Exam in Brisbane, Australia
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.