Feeds

Fiendish Internet Explorer 10 zero-day targets US soldiers

Malware blizzard timed to coincide with snowstorms

3 Big data security analytics techniques

Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel.

Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser.

However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign Wars’ website.

Wolfgang Kandek, CTO at clod security firm Qualys, said the attack can be mitigated by either upgrading to IE 11 or using Microsoft’s Experience Mitigation Toolkit (EMET). Earlier version of IE are not affected, he adds.

"The attack is using a Adobe Flash Object to set up the environment for the rest of the exploit," Kandek explained in a blog post. "Currently this 0-day vulnerability only applies to Internet Explorer 10, other versions are not affected.

"(Microsoft's security toolkit) EMET, as (was the case) many times during the IE 0-days of last year, is also successful in preventing the exploit from running successfully, but this time because it actually checks for its presence and aborts if EMET is found."

The breach targets IE 10 users visiting the compromised website through a classic drive-by download attack. The exploit targets IE 10 with Adobe Flash.

Running the latest versions of both versions of software won't help but the exploits aborts exploitation if the user is either browsing with a different version of IE or is using EMET with IE 10. If successful, malicious code will be used to download a encoded payload from a remote server, decode and execute it.

"The vulnerability is a use-after-free bug that gives the attacker direct memory access at an arbitrary address using a corrupted Adobe Flash file," an advisory from antivirus vendor Malwarebytes explains. "It then bypasses both Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)."

The attack drops malware binaries disguised as data or text files into temp directories. And these files are digitally signed to try to disguise their malign nature and make them look like a legitimate application.

FireEye yesterday said it reckoned the watering hole-style attack was careful timed to maximise the potential damage it unleashed.

"We believe the attack is a strategic Web compromise targeting American military personnel amid a paralysing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend," an advisory from FireEye explains. "Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra)."

The firm's spokesperson has since been in touch to claim: "We have linked the threat actor back to DeputyDog and Ephemeral Hydra, where we have already confirmed an origin based in China."

The spies behind the attack have previously targeted US government entities, Japanese firms, defines contractors, law firms, information technology companies, mining operations and non-governmental organisations (NGOs). The same hacking crew is suspected of involvement in a high-profile hack against whitelisting firm Bit9.

One of the more capable state-backed hacking crews in China has to be among the suspects for all this malfeasance even though, as usual, there's no hard proof to support this theory. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.