A previously unknown exploit which afflicts Internet Explorer 7 and 8 on Windows XP, Vista and 7 has been discovered by AlienVault. This "zero-day" malware acts as a bot which takes control of the user's computer in service of its own uses. AlienVault reveals that those responsible for the code also authored a zero day exploit in Java just weeks ago.
The exploit installs a Poison Ivy backdoor Trojan on computers that it comes in contact with. Hundreds of millions of Internet Explorer users are vulnerable to this malware, should they visit an infected site.
Ars Technica spoke to HD Moore, the CSO of security firm Rapid7, who said that "the attacks are exploiting a use-after-free vulnerability in IE that allows attackers to create an image URL that references uninitialized memory. The in-the-wild attacks appear to be targeting only Windows XP systems. But with the release of Matasploit code that works on a much wider array of platforms, it wouldn't be surprising to see attacks target those systems as well."
According to the site, a number of utilities and applications use IE code, allowing for hackers to transfer the exploit's code into a nearby computer through public WiFi systems and unsecured networks.
WebProNews explains that "the current zero day exploit affects over 41 percent of Internet users in the United States and 32 percent around the world."
In a statement, Microsoft's director of Trustworthy Computing Yunsun Wee states that the company is conscious of "targeted attacks potentially affecting some versions of Internet Explorer," and that "Internet Explorer 10 is not affected by this issue."
While Microsoft prepares a fix for the zero day exploit, be sure to use alternate web browsers such as Google Chrome and Mozilla Firefox for everyday purposes.