Spyware hijacks IE7

New features in Microsoft's latest browser could allow spyware developers new means to infect computers.

According to Trend Micro's anti-spyware CTO Ed English, spyware makers are looking at new functionalities of IE7 such as tabbed browsing, RSS feeds and search boxes as a way of getting revenue-generating malware onto machines.

"IE7 will soon be installed on people's computers through Windows Updates and become the world's dominant browser. There is a lot of opportunity for spyware to enter through hijacked tabs or search boxes."

English also said that hackers could inject code into RSS feeds which would then in turn download spyware onto computers.

Fraser Howard, principal virus researcher at SophosLabs, said that with IE7 new abilities to subscribe to feeds from third party sites, there is little consideration for the implications of this.

"Scope exists for the content to contain JavaScript, and historically, such script has been executed within some feed readers," said Howard. "Readers (which of course includes browsers that serve as feed readers) give differing results with such content."

Howard said that one of IE7's new features, OpenSearch, which enables third party sites to add some simple code to their page in order for the user to add that site to their default search list, could be subverted.

"If the mechanism by which the user prompt is bypassed this could provide mechanism to direct searches to specific servers, so potentially revenue generating," he said. "History tells us presenting users with more dialogs is often sufficient for them to blindly accept them. I can imagine there will be public demand for a script cleanup utility to restore default list of search providers in IE7 following infection with malware."

Donal Casey, security consultant at Morse, said that spyware developers were looking beyond the browser and had Vista's new sidebar in their sights. He said that companies are also given access to the API for this bar to develop their own gadgets or mini applications (weather, google earth shots etc).

"Unscrupulous developers could potentially create 'useful' gadgets/mini applications such as alerts for MySpace email, stock tickers, etc. that could also be used to monitor things like computer usage," said Casey. "Business should be on the guard against this and ensure people only use gadgets or mini applications recommended by the IT department."

Email to a friend

Print this page