驚爆0day漏洞,IE應(yīng)該是去還是留?
來源:華爾街郵報
2010-01-19 12:05
French and German government agencies have told people they should ditch Microsoft’s Internet Explorer browser, at least temporarily, because of a security hole that hackers are thought to have exploited on recent cyberattacks against Google and other companies. What should you do?
法國和德國的政府相關(guān)部門已經(jīng)告知人民他們應(yīng)該停止使用IE瀏覽器,至少是臨時性停止,因為在最近Google和其他公司遭受的網(wǎng)絡(luò)攻擊中暴露了IE存在的一個漏洞。面對這種危險,你能做什么呢?
Switching to an alternative Web browser like Firefox or Google Chrome is one possibility. For now, security companies like McAfee have only identified the latest security exploit as an Internet Explorer issue, but there’s no guarantee that they won’t find vulnerabilities in other browsers that were involved in the broad attack on Google and others.
一種可能是換用其他可選的瀏覽器,比如火狐(Firefox)或者Google Chrome瀏覽器。到目前為止,像McAfee這樣的安全公司只確認(rèn)了最近的安全問題存在于IE瀏覽器,不過不保證黑客們找不到其他瀏覽器的弱點來進(jìn)行類似對Google和其他公司的攻擊。
Generally speaking, a browser switch is going to be a lot easier for an individual than it will be for corporate users, where IT policies often dictate which browser people use on their computers. Graham Cluley, a senior technology consultant and security firm Sophos, said in a blog post Monday that companies may cause “more problems than it’s worth by summarily switching browsers” because of the potential for employee confusion and Web site compatibility problems caused by the new software.
一般來說,普通人換個瀏覽器比公司職員要容易很多,公司里一般會有IT政策規(guī)定人們電腦里用什么瀏覽器。Graham Cluley 是一家網(wǎng)絡(luò)安全公司的資深技術(shù)顧問,他周一發(fā)表一篇博客說,公司如果立刻換瀏覽器的話有可能會造成“更大的問題”,因為新的軟件可能會導(dǎo)致員工使用上以及網(wǎng)站在兼容性方面出現(xiàn)問題。
“My advice is to only switch from Internet Explorer if you really know what you are doing with the browser you’re swapping to,” Mr. Cluley said. “Otherwise it might be a case of ‘better the devil you know.’”
Cluley說“我的建議是如果你確定知道怎么使用要換的瀏覽器的話,不要用IE了,否則的話,就是‘暗箭難防’的活生生的例子?!?/div>
For people who don’t want to or can’t move to another browser from Internet Explorer, they should upgrade to the latest version of the software, Internet Explorer 8. While that version of the browser is also technically vulnerable to the security flaw it contains features that minimize the threat, Microsoft says.
對于那些不愿意或者不能換瀏覽器用的人來說,他們應(yīng)該升級到最新的版本IE8。據(jù)微軟說,雖然IE8仍然有可被攻擊的技術(shù)弱點,不過它自身的特性可以把威脅降到最低。
And if switching to IE 8 isn’t an option, users with earlier versions of the browser, like IE 6, should adjust their security settings to “high,” which also reduces the risk of running malicious code, Microsoft says. There’s more in blog posts from Microsoft and McAfee describing the hack and precautions for users.
如果你不能升級到IE8,還在使用較早的版本,比如你是IE6的用戶,那就應(yīng)該把電腦的安全設(shè)定調(diào)成“高”,微軟說這樣也能降低惡意代碼運(yùn)行的風(fēng)險。在微軟和McAfee的博客里都有很多帖子寫了這次的攻擊和用戶應(yīng)該如何應(yīng)對的內(nèi)容。