Tool-kit targets Image Uploader
Once again, Facebook and MySpace users are being reminded to beware when they use plug-ins. Symantec is encouraging members to update their Image Uploader ActiveX control to version 4.5.57.1 because hackers are actively exploiting it with a multi-attack kit. If you're using Aurigma Inc.'s Image Uploader to upload photos to your profiles - it's just one of five in a new hacker toolkit being used by several attack sites.
I find it strange that two of the bugs were already patched over eight months ago - but the Uploader and Yahool weaknesses were only just revealed to the public in recent weeks. Unfortunately, it looks like hackers won't be easing up on these attacks in the foreseeable future. We'll just have to stay a step ahead.
A Computerworld article by Gregg Keizer (read it here) notes that "after the Uploader and Yahoo Music Jukebox vulnerabilities were disclosed, the U. S. Computer Emergency Readiness Team (US-CERT), which is part of the U.S. Department of Homeland Security, recommended IE users disable ActiveX."
Free Insider Guide