Feeds

Fiendish Internet Explorer 10 zero-day targets US soldiers

Malware blizzard timed to coincide with snowstorms

Seven Steps to Software Security

Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel.

Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser.

However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign Wars’ website.

Wolfgang Kandek, CTO at clod security firm Qualys, said the attack can be mitigated by either upgrading to IE 11 or using Microsoft’s Experience Mitigation Toolkit (EMET). Earlier version of IE are not affected, he adds.

"The attack is using a Adobe Flash Object to set up the environment for the rest of the exploit," Kandek explained in a blog post. "Currently this 0-day vulnerability only applies to Internet Explorer 10, other versions are not affected.

"(Microsoft's security toolkit) EMET, as (was the case) many times during the IE 0-days of last year, is also successful in preventing the exploit from running successfully, but this time because it actually checks for its presence and aborts if EMET is found."

The breach targets IE 10 users visiting the compromised website through a classic drive-by download attack. The exploit targets IE 10 with Adobe Flash.

Running the latest versions of both versions of software won't help but the exploits aborts exploitation if the user is either browsing with a different version of IE or is using EMET with IE 10. If successful, malicious code will be used to download a encoded payload from a remote server, decode and execute it.

"The vulnerability is a use-after-free bug that gives the attacker direct memory access at an arbitrary address using a corrupted Adobe Flash file," an advisory from antivirus vendor Malwarebytes explains. "It then bypasses both Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)."

The attack drops malware binaries disguised as data or text files into temp directories. And these files are digitally signed to try to disguise their malign nature and make them look like a legitimate application.

FireEye yesterday said it reckoned the watering hole-style attack was careful timed to maximise the potential damage it unleashed.

"We believe the attack is a strategic Web compromise targeting American military personnel amid a paralysing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend," an advisory from FireEye explains. "Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra)."

The firm's spokesperson has since been in touch to claim: "We have linked the threat actor back to DeputyDog and Ephemeral Hydra, where we have already confirmed an origin based in China."

The spies behind the attack have previously targeted US government entities, Japanese firms, defines contractors, law firms, information technology companies, mining operations and non-governmental organisations (NGOs). The same hacking crew is suspected of involvement in a high-profile hack against whitelisting firm Bit9.

One of the more capable state-backed hacking crews in China has to be among the suspects for all this malfeasance even though, as usual, there's no hard proof to support this theory. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.