Feeds

Fiendish Internet Explorer 10 zero-day targets US soldiers

Malware blizzard timed to coincide with snowstorms

Protecting against web application threats using SSL

Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel.

Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser.

However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign Wars’ website.

Wolfgang Kandek, CTO at clod security firm Qualys, said the attack can be mitigated by either upgrading to IE 11 or using Microsoft’s Experience Mitigation Toolkit (EMET). Earlier version of IE are not affected, he adds.

"The attack is using a Adobe Flash Object to set up the environment for the rest of the exploit," Kandek explained in a blog post. "Currently this 0-day vulnerability only applies to Internet Explorer 10, other versions are not affected.

"(Microsoft's security toolkit) EMET, as (was the case) many times during the IE 0-days of last year, is also successful in preventing the exploit from running successfully, but this time because it actually checks for its presence and aborts if EMET is found."

The breach targets IE 10 users visiting the compromised website through a classic drive-by download attack. The exploit targets IE 10 with Adobe Flash.

Running the latest versions of both versions of software won't help but the exploits aborts exploitation if the user is either browsing with a different version of IE or is using EMET with IE 10. If successful, malicious code will be used to download a encoded payload from a remote server, decode and execute it.

"The vulnerability is a use-after-free bug that gives the attacker direct memory access at an arbitrary address using a corrupted Adobe Flash file," an advisory from antivirus vendor Malwarebytes explains. "It then bypasses both Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)."

The attack drops malware binaries disguised as data or text files into temp directories. And these files are digitally signed to try to disguise their malign nature and make them look like a legitimate application.

FireEye yesterday said it reckoned the watering hole-style attack was careful timed to maximise the potential damage it unleashed.

"We believe the attack is a strategic Web compromise targeting American military personnel amid a paralysing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend," an advisory from FireEye explains. "Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra)."

The firm's spokesperson has since been in touch to claim: "We have linked the threat actor back to DeputyDog and Ephemeral Hydra, where we have already confirmed an origin based in China."

The spies behind the attack have previously targeted US government entities, Japanese firms, defines contractors, law firms, information technology companies, mining operations and non-governmental organisations (NGOs). The same hacking crew is suspected of involvement in a high-profile hack against whitelisting firm Bit9.

One of the more capable state-backed hacking crews in China has to be among the suspects for all this malfeasance even though, as usual, there's no hard proof to support this theory. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.