Quintin‧速記本

By Jonathan Fildes Technology reporter, BBC News

Cliff Evans of Microsoft says IE8 is more secure than other browsers

France has echoed calls by the German government for web users to find an alternative to Microsoft's Internet Explorer (IE) to protect security.

Certa, a government agency that oversees cyber threats, warned against using all versions of the web browser.

Germany warned users on Friday after malicious code - implicated in attacks on Google - was published online.

But Microsoft told BBC News that IE8 was the "most secure browser on the market" and people should upgrade.

Cliff Evans, head of security and privacy, said that so far the firm had only seen malicious code that targeted the older version of its browser, IE6.

"The risk is minimal," he said.

For a web user to be affected, he said, they would have to be using IE6 and visit a compromised website.

"There are very few of them out there," he told BBC News.

However, if this did occur, a PC could become infected with a "trojan horse", allowing a hacker to take control of the computer and potentially steal sensitive information.

'Sophisticated attack'

Although the vulnerability has so far been exploited only in IE6, security researchers warned that could soon change.

"Microsoft themselves admit there is a vulnerability, even in IE8," said Graham Cluley of security firm Sophos.

This terrible piece of PR for Microsoft comes just as the IE browser which had almost total control of the market starts to come under pressure... Rory Cellan-Jones, BBC technology correspondent Has China helped Google in the browser wars?

Mr Cluley said that because details of the exploit were now available online, hackers could soon change the code to target other versions of the browser.

He warned web users to be careful about clicking on links in unsolicited e-mails and advised all web users to upgrade their browser to the latest version, no matter which software they used.

The advice follows revelations that a "targeted and sophisticated" attack on Google exploited the vulnerability.

Google said last week that an attack on its corporate network had targeted the e-mail accounts of human rights activists.

The attack led Google to announce that it might withdraw from China, after it revealed that the attacks had probably originated in the country.

Following the news, Germany's Federal Office for Information Security issued a warning against all versions of Internet Explorer and recommended that users switch to an alternative such as Firefox or Google's Chrome.

The French agency Certa issued a similar warning.

"Pending a patch from the publisher, Certa recommends using an alternative browser," it said.

The UK government had said that it would not issue a similar warning. However, it said the Centre for the Protection of National Infrastructure (CPNI)was "monitoring the situation" and would "publish further advice if the risks change".

Patch path

But Mr Evans said that calls to change browsers were "not very helpful".

"If you look at other browsers, it's likely they will have other vulnerabilities," he said.

The vulnerability was found to be used in an attack on Google

He pointed to a report by security firm NSS Labs reportedly showing that IE8 provided better security against phishing and malware than other browsers.

"We feel strongly that IE8 is most secure browser on the market," Mr Evans said.

His advice was echoed by Mr Cluley.

"Switching away will get away from this particular problem," he told BBC News. "But all browsers have security flaws."

Mr Cluley said that switching away from IE could create other problems, particularly for companies.

"Some web-based applications may not work at all if you're not using Internet Explorer."

Microsoft is currently working on a patch for the problem, but a spokesperson said it could not commit to a timeframe.

The firm traditionally releases a security update once a month - the next scheduled patch will be ready on 9 February.

法國也加入「建議不要使用IE」的行列了~

By Daniel Emery Technology Reporter, BBC News

The warning applies to versions 6, 7 and 8 of Internet Explorer

The German government has warned web users to find an alternative browser to Internet Explorer to protect security.

The warning from the Federal Office for Information Security comes after Microsoft admitted IE was the weak link in recent attacks on Google's systems.

Microsoft rejected the warning, saying that the risk to users was low and that the browsers' increased security setting would prevent any serious risk.

However, German authorities say that even this would not make IE fully safe.

Thomas Baumgaertner, a spokesman for Microsoft in Germany, said that while they were aware of the warning, they did not agree with it, saying that the attacks on Google were by "highly motivated people with a very specific agenda".

"These were not attacks against general users or consumers," said Mr Baumgaertner.

"There is no threat to the general user, consequently we do not support this warning," he added.

Microsoft says the security hole can be shut by setting the browser's security zone to "high", although this limits functionality and blocks many websites.

However, Graham Cluley of anti-virus firm Sophos, told BBC News that not only did the warning apply to 6, 7 and 8 of the browser, but the instructions on how to exploit the flaw had been posted on the internet.

"This is a vulnerability that was announced in the last couple of days. Microsoft have no patch yet and the implication is that this is the same one that exploited on the attacks on Google earlier this week," he said.

Computer expert Alan Stevens: "It's like having a window left open in your house"

"The way to exploit this flaw has now appeared on the internet, so it is quite possible that everyone is now going to have a go."

Microsoft traditionally release a security update once a month - the next scheduled patch is the 9th of February. However, a spokesman for Microsoft told BBC News that developers for the firm were trying to fix the problem.

"We are working on an update on this issue and this may well involve an out of cycle security update," he said.

Fix development

However, this is no easy task. Not only have the firm got to fix the loophole, but they have to ensure it does not create another one and - equally importantly - works on all computers. This is a challenge compounded by the fact they have to fix three different versions of its browser.

Microsoft said that while all versions of Internet Explorer were affected, the risk was lower with more recent releases of its browser.

The other problem facing developers is that the possible risk might not be prevented by anti-virus software, even when recently updated.

"We've been working to analyse the malware that the Chinese are using. But new versions can always be created," said Mr Cluley.

"We've been working with Microsoft to see if the damage can be mitigated and we are hoping that they will release an emergency patch.

"One thing that should be stressed is that every browser has its security issues, so switching may remove this current risk but could expose you to another."

你想當德國人嗎？哈哈