Feeds

Exploit code for potent IE zero-day bug goes wild

'Fairly reliable'

Security for virtualized datacentres

Updated Exploit code targeting the Internet Explorer vulnerability used against Google and other companies has gone public, increasing the chances that broader attacks will soon follow.

Both the open-source Metasploit framework and the commercial Immunity Canvas software for penetration testers have working exploits that fully compromise computers running earlier versions of the browser. The attacks target a previously unknown invalid pointer reference bug in IE that attackers used to penetrate the defenses of Google and dozens of other companies.

The exploits come as the German Federal Office for Information Security said IE users should switch to an alternative browser until a patch for IE has been made available.

The exploit in Canvas was "fairly reliable" at remotely executing code in tests of IE versions 6 and 7 running on Windows XP SP3, Immunity researcher Kostya Kortchinsky wrote in an email. "It crashed IE 8 and will require a bit more work to get something out of it," he added.

The exploit folded into Metasploit was tested on IE 6 running on the same Windows platform, the framework's chief maintainer, H D Moore, wrote in a blog post.

While the flaw affects all versions of IE except for 5.01 SP 4, security protections built in to more recent versions of the browser and operating system can significantly mitigate the threat. DEP, short for data execution prevention, is enabled by default in IE 8 but must be manually turned on in prior versions. Users of Vista and later versions of Windows should run IE in protected mode, an additional feature that also provides important protection.

We've said it before, and given the particulars of this vulnerability, we'll say it again: security measures like DEP and ASLR, or address space layout randomization, matter. As ugly as this vulnerability is - to say nothing of its ability to remain undetected for nine years - the fact that Windows 7 and IE 8 were able to withstand the "highly sophisticated" attacks that felled Google is testament that Microsoft is making significant progress.

Shortly after this article was first published, Microsoft issued a statement that largely repeated the same mitigation details. But it also said researchers continue to see only "limited targeted attacks affecting Internet Explorer 6." It went on to "encourage" users of IE 6 and 7 to upgrade to the latest version "to benefit from the improved security features and defense in depth protections offered such as data execution prevention and smartscreen."

The advice is sound. If it's at all possible, upgrade to IE 8 now. The computer you save may be your own.

Microsoft hasn't said when it expects to fix the bug. Its next regular update release is scheduled for February 9. Speculation is growing that the company will issue an out-of-band patch.

Moore said the Metasploit maintainers got their hands on the exploit after it was uploaded to Wepawet. Kortchinsky said Immunity researchers believe their exploit is the same one but can't be sure. Anti-virus provider McAfee, which first discovered the exploitation of the zero-day flaw, said here that the public exploits use the same code it has observed.

So far, exploitation of the IE bug has been seen only in highly targeted attacks that hit Google and at least some of the other 33 large companies that experienced similar assaults. With the public release of exploit code, the likelihood of much broader scams targeting the vulnerability are much greater. ®

This article was updated to add reporting and commentary.

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.