New deadly phishing bug in IE7

Security researcher Michal Zalewski said he has discovered a relatively new security vulnerability in Internet Explorer 7.

The cause of the above security hole is an error in the way the browser handles the function ' document.open () ' when receiving a command that opens a new window. This error can be exploited to fake the website address displayed on the browser's Address bar.

This is an extremely dangerous form of attack by ordinary users, which is very difficult to detect. Especially in case hackers fake phishing website addresses identical to legitimate website addresses plus an almost identical interface.

However, security firm Secunia only ranked this error on a dangerous level 2/5 - equivalent to a level of danger below average.

Michal Zalewski confirmed that the version of Internet Explorer 7 running on the Windows XP SP2 operating system, which was fully installed, still had the above security flaws. Other versions may also make mistakes.

Users are advised to be careful when accessing unreliable websites.

Hoang Dung