Faculty and Staff,

A particularly dangerous bug in Internet Explorer was discovered last month and reports are coming out this morning that malicious code to exploit the bug is now circulating. This bug is exclusive to Internet Explorer for the PC. FireFox users are not affected. Here is what you need to know:First, the bottom line: More than ever, you do not want to click any link in an e-mail message originating from an unknown sender or from officially looking notifications supposedly from your bank, credit card company, PayPal, eBay, etc... If you receive an e-mail that appears to come from a company with whom you do business, open your web browser and manually type in the company's web address. The details: The bug makes it possible to "spoof" the link in an e-mail message AND the web address in Internet Explorer's address bar. We've all seen officially looking e-mail messages supposedly originating from banks, credit card companies, eBay, PayPal, etc... These e-mail messages usually contain a link pointing to a malicious website. The link text may say something like http://www.wellsfargo.com/accounts, but hovering the mouse over the link would reveal the true address in the information bar at the bottom of your browser window. It is usually suspicious looking like http://www.welsfargo.ru or http://204.32.234.54/accts-112/1442cgvc/. This new bug makes it possible to now receive an e-mail with a link that really looks like it goes to http://www.wellsfargo.com/accounts. Furthermore -- and here is the real danger -- if you click on that link, you will be taken to a malicious website but your IE browser will still say http://www.wellsfargo.com/accounts in the address bar. Most of us have come to depend on the address bar to tell us where we are visiting. Until a patch is made available, the address bar can't be fully trusted, particularly in the e-mail phishing scenario I describe. Secunia, an Internet security company, has made a page available to test the problem. Follow the instructions under Test Case / Demonstration:

http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/

Thanks, Greased Lighting