New IE hole exploited in attacks on U.S. firms

http://news.cnet.com/8301-27080_3-10435232-245.html?tag=contentMain;contentBody

 

From the article:

Social engineering tactics seem to be a common denominator in these exploits. Another case where common sense will prevail.

...and if that fails:

...a default deny policy should provide ample backup.

 

The social engineering wouldn't have worked if these attackers had not found a 0-day flaw in IE. But, I do agree with you that this seems like an inside job, and is probably the reason google is threatening to leave China. I would wager some of Google's Chinese employees were involved.

 

To be honest, it never occured to me as an inside job, but your theory could be right. It just seems like a lesson to be learned; do not carelessly click on links and don't run as administrator, allowing unsolicited executables to launch. It looks again like another case where antivirus is a half-arssed security solution.