Never miss a great news story!
Get instant notifications from Economic Times
AllowNot now


You can switch off notifications anytime using browser settings.
11,921.50-96.9
Stock Analysis, IPO, Mutual Funds, Bonds & More

Internet Explorer bug allows hackers to steal data even if browser is not in use

The file format is used by Internet Explorer for its web archives and a user only needs to open the malicious attachment received either by email, messenger, or any other file transfer service, Mashable reports.

ANI|
Apr 15, 2019, 10.56 PM IST
0Comments
Agencies
Hacking
The file format is used by Internet Explorer for its web archives and a user only needs to open the malicious attachment received either by email, messenger, or any other file transfer service, Mashable reports.
California: A security researcher has discovered a vulnerability in Microsoft's Internet Explorer which allows hackers to potentially steal user data even if they don't use the browser.

Security researcher John Page explained that the browser is vulnerable to XML External Entity attack if a user opens something malicious. MHT file locally, allowing hackers to remotely access the computer and exfiltrate local files.

The file format is used by Internet Explorer for its web archives and a user only needs to open the malicious attachment received either by email, messenger, or any other file transfer service, Mashable reports.

Once a user opens the malicious file, it launches the browser. Afterwards, even if the commands such as 'Ctrl+K' for tab duplication, 'Print Preview', or 'Print' are used on the webpage, it may trigger the XXE vulnerability.

Typically, Internet Explorer alerts users with a security bar if one tries to access objects like 'Microsoft.XMLHTTP'. However, with the specially crafted. MHT file using the malicious XML markup tags, no such warnings are shown.

The vulnerability has been tested using Internet Explorer 11 and affects Windows 7, Windows 19, and Windows Server 2012 R2 users.

Also Read

Apple's Safari is now 'the new Internet Explorer'

Microsoft unveils 'Edge', successor to Internet Explorer

Microsoft unveils 'Edge', successor to Internet Explorer

Windows 10 may have new browser, Internet Explorer on way out

Comments
Add Your Comments
Commenting feature is disabled in your country/region.
Download The Economic Times Business News App for the Latest News in Business, Sensex, Stock Market Updates & More.

Other useful Links


Follow us on


Download et app


Copyright © 2019 Bennett, Coleman & Co. Ltd. All rights reserved. For reprint rights: Times Syndication Service