Fiendish Internet Explorer 10 zero-day targets US soldiers

Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel.

Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser.

However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign Wars’ website.

Wolfgang Kandek, CTO at clod security firm Qualys, said the attack can be mitigated by either upgrading to IE 11 or using Microsoft’s Experience Mitigation Toolkit (EMET). Earlier version of IE are not affected, he adds.

"The attack is using a Adobe Flash Object to set up the environment for the rest of the exploit," Kandek explained in a blog post. "Currently this 0-day vulnerability only applies to Internet Explorer 10, other versions are not affected.

"(Microsoft's security toolkit) EMET, as (was the case) many times during the IE 0-days of last year, is also successful in preventing the exploit from running successfully, but this time because it actually checks for its presence and aborts if EMET is found."

The breach targets IE 10 users visiting the compromised website through a classic drive-by download attack. The exploit targets IE 10 with Adobe Flash.

Running the latest versions of both versions of software won't help but the exploits aborts exploitation if the user is either browsing with a different version of IE or is using EMET with IE 10. If successful, malicious code will be used to download a encoded payload from a remote server, decode and execute it.

"The vulnerability is a use-after-free bug that gives the attacker direct memory access at an arbitrary address using a corrupted Adobe Flash file," an advisory from antivirus vendor Malwarebytes explains. "It then bypasses both Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)."

The attack drops malware binaries disguised as data or text files into temp directories. And these files are digitally signed to try to disguise their malign nature and make them look like a legitimate application.

FireEye yesterday said it reckoned the watering hole-style attack was careful timed to maximise the potential damage it unleashed.

"We believe the attack is a strategic Web compromise targeting American military personnel amid a paralysing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend," an advisory from FireEye explains. "Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra)."

The firm's spokesperson has since been in touch to claim: "We have linked the threat actor back to DeputyDog and Ephemeral Hydra, where we have already confirmed an origin based in China."

The spies behind the attack have previously targeted US government entities, Japanese firms, defines contractors, law firms, information technology companies, mining operations and non-governmental organisations (NGOs). The same hacking crew is suspected of involvement in a high-profile hack against whitelisting firm Bit9.

One of the more capable state-backed hacking crews in China has to be among the suspects for all this malfeasance even though, as usual, there's no hard proof to support this theory. ®