Feeds

Fiendish Internet Explorer 10 zero-day targets US soldiers

Malware blizzard timed to coincide with snowstorms

Securing Web Applications Made Simple and Scalable

Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel.

Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser.

However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign Wars’ website.

Wolfgang Kandek, CTO at clod security firm Qualys, said the attack can be mitigated by either upgrading to IE 11 or using Microsoft’s Experience Mitigation Toolkit (EMET). Earlier version of IE are not affected, he adds.

"The attack is using a Adobe Flash Object to set up the environment for the rest of the exploit," Kandek explained in a blog post. "Currently this 0-day vulnerability only applies to Internet Explorer 10, other versions are not affected.

"(Microsoft's security toolkit) EMET, as (was the case) many times during the IE 0-days of last year, is also successful in preventing the exploit from running successfully, but this time because it actually checks for its presence and aborts if EMET is found."

The breach targets IE 10 users visiting the compromised website through a classic drive-by download attack. The exploit targets IE 10 with Adobe Flash.

Running the latest versions of both versions of software won't help but the exploits aborts exploitation if the user is either browsing with a different version of IE or is using EMET with IE 10. If successful, malicious code will be used to download a encoded payload from a remote server, decode and execute it.

"The vulnerability is a use-after-free bug that gives the attacker direct memory access at an arbitrary address using a corrupted Adobe Flash file," an advisory from antivirus vendor Malwarebytes explains. "It then bypasses both Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)."

The attack drops malware binaries disguised as data or text files into temp directories. And these files are digitally signed to try to disguise their malign nature and make them look like a legitimate application.

FireEye yesterday said it reckoned the watering hole-style attack was careful timed to maximise the potential damage it unleashed.

"We believe the attack is a strategic Web compromise targeting American military personnel amid a paralysing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend," an advisory from FireEye explains. "Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra)."

The firm's spokesperson has since been in touch to claim: "We have linked the threat actor back to DeputyDog and Ephemeral Hydra, where we have already confirmed an origin based in China."

The spies behind the attack have previously targeted US government entities, Japanese firms, defines contractors, law firms, information technology companies, mining operations and non-governmental organisations (NGOs). The same hacking crew is suspected of involvement in a high-profile hack against whitelisting firm Bit9.

One of the more capable state-backed hacking crews in China has to be among the suspects for all this malfeasance even though, as usual, there's no hard proof to support this theory. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Boffins build FREE SUPERCOMPUTER from free cloud server trials
Who cares about T&Cs when there's LIteCoin to mint?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.