Feeds

Digital delinquents thrive on IE6 exploits

Fiesta attack tool drives through swiss-cheese browser

Next gen security for virtualised datacentres

Hackers have more more luck targeting users of older versions of Internet Explorer for exploitation than other demographics, according to figures culled from a popular attack tool.

Web security firm PrevX lifted the illuminating stats after breaking into the an open admin panel for the Fiesta exploit pack, one of the current favourites in the digital underground. Fiesta 2.4, which sells for around $850 a pop in black-hat hacker bazaars, targets a raft of 25 vulnerabilities. It's installed on web servers and used to distribute adware, banking Trojans and the like.

Attacks against unpatched PDF browser-rendering vulnerabilities are at the top of the list of exploits it targets, in terms of success. These security holes are used to distribute malware through drive-by download attacks, as PrevX explains.

"The exploit pack is used to provide 'loads'. This is slang for malware distribution. What will happen in practice is, webmasters of high traffic sites (mainly porn etc) send traffic to a certain page on another server, example: (www.blah123.com/infect/index.php) This might be done in an iFrame. The victims browser will then go through a series of exploits, to see if they are vulnerable to any of them," PrevX CTO Jacques Erasmus writes.

Those who use it are working in the engine room of malware distribution, Erasmus told El Reg

PrevX reported the exploit pack to its ISP host in eastern Europe on Tuesday. The tool remains live at the time of writing on Wednesday afternoon.

While it waits for the pack's takedown, PrevX is monitoring the malware tool's progress in infecting unsuspecting marks, many of whom are exposed to attack after visiting dodgy high traffic sites popular with Russians and Poles, the target audience of the attack.

Of 1,422 possible victims running IE6 and lured onto the site, 427 (30 per cent) were infected. By comparison, a similar number of 1,547 surfers redirected onto a maliciously-constructed site resulted in 103 infections, a much lower rate of just 6.65 per cent. One unlucky user of IE8 was infected from a small sample of 13 possible victims.

The chances of a Russian surfer getting infected via the tool are running at 18 per cent of visitors, compared to 9 per cent for Polish web users, a finding that suggests Poles are doing a better job of keeping their machines up to date.

To date, 79 of 1,049 Opera users (0.7 per cent) have been hit and none of 1,995 Firefox fans. The latter finding probably reflects more about the effectiveness of the attack tool than the security preparations of fans of the open source browser.

PrevX's findings that older browsers are vulnerable are not a big surprise, but a practical example of a security truism is nonetheless noteworthy. "IE6 has lots of vulnerabilities, so if it's not patched you're gonna get hit," Erasmus said. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.