Update: Microsoft patches up Internet Explorer

Microsoft admitted today that a serious flaw in security has left the majority of the world’s internet users exposed to attacks from hackers hoping to steal personal data and passwords.

A loophole in Internet Explorer (IE), the default web browser on most computers, allows criminals to commandeer victims’ PCs by tricking them into visiting unsafe websites.

It is thought that two million computers have already been affected as Microsoft conceded that 1 in 500 internet users may have been exposed.

Specialists question 'fastest' broadband

As Virgin Media claims to be rolling out unprecedented service, experts raise doubts over reach and the extent of its top speed

• Commentary: Virgin Media's broadband rollout

• ASA questions truth of Virgin broadband claim

• Virgin ups stakes with superfast broadband

Related Links

• Lawyer serves court papers on Facebook

• Specialists question 'fastest' broadband

Computer users are advised by some security experts to switch to an alternative internet browser, such as Firefox or Google Chrome, to avoid the hackers who have so far corrupted an estimated 10,000 websites.

Microsoft said that it is considering the release of an emergency update to correct the flaw. The computing company claims that it has only detected attacks on Internet Explorer 7, the most common version of the browser, but gave warning that other versions are also potentially vulnerable.

The hack was initially devised by Chinese criminals, who have been stealing computer game passwords that can be sold on the black market.

However, Paul Ferguson, a security researcher for Trend Micro Inc, an anti-spyware provider, said that the security breach is so severe that it could be “adopted by more financially motivated criminals for more serious mayhem — that’s a big fear right now”.

Since the security flaw was reported on December 9, Microsoft said that there has been an exponential increase in attacks attempting to make use of the vulnerability. These opportunistic hackers who exploit known security breaches are called “zero-day” attackers.

These threats occur as hackers race against software makers to attack the affected programmes, such as IE, before the known problems are repaired.

“Zero days are unusual — and zero days in the world’s most popular browser on the world’s most popular operating system are really unusual,” said a Trend Micro spokesman. “The threat from it is only going to grow."

John Curran, a spokesman for Microsoft, said: “Right now it’s affecting about 0.2 per cent of users who may have come in touch with the vulnerability.

Explore Tech & Web

• Personal Tech

• The Web

• Gadgets & Gaming