What strikes me as interesting about this attack is that the focus is on Microsoft’s Internet Explorer 6. Internet Explorer 6 was released in August 2001. Internet Explorer 7 was released in October 2006. Internet Explorer 8 was released in March 2009. So, the recent attacks focused on a 8+ year old application that has been superceded by two full revisions. Didn’t anyone use automatic updates to update their IE? What kept people from updating IE?

I know that Microsoft has released an out-of-cycle update to address the vulnerability. This is a cumulative update for all currently supported of Internet Explorer. So, will this update get applied to at-risk systems? Hmmm… I wonder since it appears that there is little movement off of older versions of Internet Explorer. The attacks were on well known organizations (Google, Adobe, Juniper). Why would they still be using this older version of IE? It seems like this would raise questions about Microsoft’s penetration of newer operating systems like Vista which would be running IE7.

IE7 had issues with compatibility and html standards. IE8 is much better. Is the compatibility issue so significant that organizations stayed on IE6 rather than moving to IE7 and/or IE8?

Please share your thoughts.

Thanks for reading and let’s continue to be good network citizens!

ComputerWorld: Conficker’s next move a mystery to researchers

Computer Reseller News: Conficker Worm to Strike April 1

USA Today: PC security forces face April 1 showdown with Conficker worm

Here’s a great analysis of the Conficker variants and some details to show what to be concerned about.

Take a look at this guidance from Microsoft on Conficker.A and Conficker.B. You need to get the MS08-067 (KB958644) patch rolled out as soon as you can to your machines.

Good luck and if there is a big outbreak on your network, break the internet connection or shutdown the machines until you get them checked & updated. Don’t be afraid to shut things down to get them cleaned up. Then… once you do get things cleaned up and can estimate the time it took… figure out how much you could have saved and look at purchasing a good asset management system like Windows Systems Center Configuration Manager to push out patches and fixes to your devices.

Thanks for reading & let’s continue to be good network citizens.