Warning: Internet Explorer Allows Hackers To Spy On You And Steal Personal Data From Your PC

A zero-day exploit found has been found on Internet Explorer meaning hackers can steal files from Windows users. That warning may seem irrelevant to you since Internet Explorer was officially discontinued in 2015. What’s particularly interesting about this security flaw is that you don’t even need to be an Internet Explorer user to be vulnerable.

It’s now an ancient web browser, only in use by about 7% of Windows users. But if take into account the total market share of Windows 7 and Windows 10, the legacy web browser is installed on more than 1 billion computers.

Security researcher John Page published proof-of-concept code detailing how the flaw could be carried out.

‘Internet Explorer is vulnerable to XML External Entity attack if a user opens a specially crafted .MHT file locally,’ Page explained.

‘This can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed Program version information.’

Hackers are reportedly exploiting a vulnerability using .MHT files – the file format used by Internet Explorer for its web archives.

Current web browsers do not use the .MHT format, so Windows automatically opens IE by default when a user attempts to access this file.

Mr Page explained: “For example, a request for “c:\Python27\NEWS.txt” can return version information for that program.

“Upon opening the malicious ‘.MHT’ file locally it should launch Internet Explorer.

Afterwards, user interactions like duplicate tab ‘Ctrl+K’ and other interactions like right click ‘Print Preview’ or ‘Print’ commands on the web-page may also trigger the XXE vulnerability.”

Mr Page says he contacted Microsoft in March before now going public with the issue.

The company does not regard it as being important enough to issue an immediate fix, saying:

We determined that a fix for this issue will be considered in a future version of this product or service. At this time, we will not be providing ongoing updates of the status of the fix for this issue, and we have closed this case.

If you are concerned about this, you should change the default association of MHT files to something other than Internet Explorer.