Feeds

Digital delinquents thrive on IE6 exploits

Fiesta attack tool drives through swiss-cheese browser

The Power of One eBook: Top reasons to choose HP BladeSystem

Hackers have more more luck targeting users of older versions of Internet Explorer for exploitation than other demographics, according to figures culled from a popular attack tool.

Web security firm PrevX lifted the illuminating stats after breaking into the an open admin panel for the Fiesta exploit pack, one of the current favourites in the digital underground. Fiesta 2.4, which sells for around $850 a pop in black-hat hacker bazaars, targets a raft of 25 vulnerabilities. It's installed on web servers and used to distribute adware, banking Trojans and the like.

Attacks against unpatched PDF browser-rendering vulnerabilities are at the top of the list of exploits it targets, in terms of success. These security holes are used to distribute malware through drive-by download attacks, as PrevX explains.

"The exploit pack is used to provide 'loads'. This is slang for malware distribution. What will happen in practice is, webmasters of high traffic sites (mainly porn etc) send traffic to a certain page on another server, example: (www.blah123.com/infect/index.php) This might be done in an iFrame. The victims browser will then go through a series of exploits, to see if they are vulnerable to any of them," PrevX CTO Jacques Erasmus writes.

Those who use it are working in the engine room of malware distribution, Erasmus told El Reg

PrevX reported the exploit pack to its ISP host in eastern Europe on Tuesday. The tool remains live at the time of writing on Wednesday afternoon.

While it waits for the pack's takedown, PrevX is monitoring the malware tool's progress in infecting unsuspecting marks, many of whom are exposed to attack after visiting dodgy high traffic sites popular with Russians and Poles, the target audience of the attack.

Of 1,422 possible victims running IE6 and lured onto the site, 427 (30 per cent) were infected. By comparison, a similar number of 1,547 surfers redirected onto a maliciously-constructed site resulted in 103 infections, a much lower rate of just 6.65 per cent. One unlucky user of IE8 was infected from a small sample of 13 possible victims.

The chances of a Russian surfer getting infected via the tool are running at 18 per cent of visitors, compared to 9 per cent for Polish web users, a finding that suggests Poles are doing a better job of keeping their machines up to date.

To date, 79 of 1,049 Opera users (0.7 per cent) have been hit and none of 1,995 Firefox fans. The latter finding probably reflects more about the effectiveness of the attack tool than the security preparations of fans of the open source browser.

PrevX's findings that older browsers are vulnerable are not a big surprise, but a practical example of a security truism is nonetheless noteworthy. "IE6 has lots of vulnerabilities, so if it's not patched you're gonna get hit," Erasmus said. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.