Global users face major security risks: Hackers can run malicious code

Microsoft issued an unconventional warning in Saturday, and security company FireEye discovered a vulnerability called "Zero Day" (0day in 0day attacks typically indicates a vulnerability that has not been patched, and, accordingly, the entire phrase represents an exploit), and the company named it " Zero Day ("0 days") is because the vulnerability is so hidden that it does not leave any time for the potential victim to receive a warning.

Attack mode

So what is "Zero day"? It is a remote code execution vulnerability. The vernacular is: After the attack succeeds, the villain can let the target computer run (specific) software. Microsoft's warning describes: "The vulnerability could crash memory and allow an attacker to execute arbitrary code in the IE browser that the user is currently using." ”

This vulnerability is derived from Flash--adobe's animation and video software, which can be further exploited to invade computer memory through a number of well-known technical tools (see here for technical details).

In some scenarios, an attacker would create a specific Web site that could take advantage of "Zero Day"-and then entice IE users to click on the site's links. Therefore, if you use IE browser, you should be more careful when you receive some suspicious emails with links to your Web pages.

Impact Range

Microsoft's comprehensive version of security recommendations revealed a number of details: 56% of browsers worldwide have been affected, including generations of browsers from IE6 to IE11. Most of these attacks were directed against IE9 to IE11 (which accounted for more than 26% of the global total), while attacks against IE6 to IE8 accounted for 56%. Microsoft says that IE10 and IE11 will start the enhanced protection mode by default, which helps users avoid this vulnerability. Microsoft is investigating the incident and will disclose it when progress is made.

Behind the Scenes

Who is behind the exploits? FireEye did not give more details, but mentioned that it was a apt group: Advanced persistent Threat (advanced constant threat)--This is the general title of FireEye to the most fearsome and technically superior attackers.

The APT group first reached a specific number of browser intrusions after the leak was released. FireEye also said, "They are extremely skilled and untraceable for hidden traces, and they never use repetitive commands and control structures." According to FireEye, the group is also related to Pirpi, which was published in 2010.