Hackers exploit latest IE zero-day with drive-by attacks
Researchers expect attacks to explode once exploit code goes public
Computerworld - Hackers are exploiting the just-disclosed unpatched bug in Internet Explorer (IE) to launch drive-by attacks from malicious Web sites, security researchers said today.
"This attack appears to be rather targeted at the moment, but as with other unpatched vulnerabilities in the past, this has the potential to explode now that the word is getting out," said Craig Schmugar, a threat researcher at McAfee, in a blog post today.
Attacks are launched from Web sites in a classic drive-by fashion, said Schmugar and others. "Visiting the page is enough to get infected," Schmugar said.
Symantec also confirmed that it has spotted in-the-wild attacks exploiting the critical vulnerability in IE6 and IE7 that Microsoft acknowledged yesterday. "We're still seeing just limited attacks," said Ben Greenbaum, a senior research manager on Symantec's security response team. "The exploit is carried out simply by visiting a Web page hosting the vulnerability. When the browser opens the page, the exploit causes the user's computer to download and execute another piece of malware."
Most of the malware downloaded and installed on the victimized PC consists of backdoors that let hackers install and run even more attack code. Among the malware is a .dll file that's injected into IE to provide additional remote access to the machine, Schmugar said.
"It started out as limited and targeted, but now, with the drive-by attacks, it's no longer only a targeted attack," he said in an interview today.
On Tuesday, Microsoft warned users of IE6 and IE7 that attackers were using an unpatched vulnerability in their browsers, but as is its practice, the company did not publish technical details of the bug.
Nor did Microsoft spell out a patching timetable, or promise that it would issue a fix before the next scheduled Patch Tuesday on April 13. Instead, it recommended that users modify access to "iepeers.dll," disable scripting and/or enable DEP (Data Execution Prevention).
According to Vupen Security, the bug is a "user-after-free" memory error in the way iepeers.dll handles certain data. "User-after-free" refers to an attempt to reuse memory space after it has been freed, said Andrew Storms, director of security operations at nCircle Network Security, in an instant-message interview.
Neither Symantec nor McAfee have yet found evidence that the attack code has been widely distributed via hacker forums or posted more prominently on the Internet. When that happens, Schmugar said, he expects attacks to quickly increase.
Microsoft may be forced to react with an emergency update if that happens, Greenbaum contended. "It's possible Microsoft may consider an out-of-band patch for this issue," he said.
Symantec notified Microsoft of its discovery of the drive-by attacks a few hours before the latter issued its advisory, Greenbaum said. "The timeline, however, makes us think that they already knew about the issue and were planning on posting the advisory very soon anyway," he noted.
Both Symantec and McAfee have created and distributed signatures that detect and block the installation of the malware that the drive-by exploit tries to inject into PCs.
Tuesday's advisory was the second in the past 60 days from Microsoft warning of ongoing attacks against an unpatched IE vulnerability. In mid-January, Microsoft said that a flaw in its browser had been used to attack several companies' networks, including Google's and Adobe's. Microsoft patched that vulnerability, and seven others, later in the month when it shipped an out-of-band update.
User can also upgrade Internet Explorer to IE8, which does not contain the bug and so is immune from attack.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at
@gkeizer or subscribe to Gregg's RSS feed
. His e-mail address is gkeizer@ix.netcom.com.
Security Alert
- Whoops! Microsoft leaks patch info four days early
- Researcher raps Apple for not blocking stolen SSL certificates
- Mac OS X can't properly revoke dodgy digital certificates
- Hackers may have stolen over 200 SSL certificates
- Apache patches Web server DoS vulnerability
- Google one of many victims in SSL certificate hack
- Hackers stole Google SSL certificate, Dutch firm admits
- Spike in mobile malware doubles Android users' chances of infection
- Microsoft patches critical Outlook drive-by bug
- 9 security suites: maximum protection, minimum fuss
Read more about Security in Computerworld's Security Topic Center.



- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Overcome Top 7 Admin Challenges of Active Directory
- As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable,...
- Insiders Can Ruin Your Company. Take Action.
- Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in...
- Top Solutions and Tools to Prevent Devastating Malware
- Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring...
- X-Ray of the PCI Process-4 Proactive Steps
- This white paper from Forrester Research Inc., helps break PCI into understandable components. Security and risk professionals will gain knowledge and insight into...
- Identity Governance: The Business Imperatives
- This white paper describes the business challenges and opportunities that are driving interest in Identity Governance while discussing considerations your organization should make... All Security White Papers
- Live Webcast
Playing Defense: Staying on Top of Your Disaster Recovery Game - When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing...
- Introduction to VMware vCenter Site Recovery Manager 5
- Traditional disaster recovery solutions are often too expensive, complex and unreliable to meet business requirements. As a result, IT departments are hesitant to...
- The Top Ten Secrets to Avoiding SAN Performance Problems
- Maintaining peak performance while simultaneously addressing the root cause of SAN errors is challenging. Learn the most common SAN problems and explore new...
- Deduplication Without Compromise
- Go inside Quantum's scalable, high-performance, multi-protocol new DXi deduplication appliances, designed to make backup much more effective. Discover how the new future-proof DXi6700...
- Director of Disk Products Discusses DXi6700
- Discover how the new DXi 6700 series of deduplication appliances provide investment protection and a future-proof feature set, all while delivering fast, scalable,...
- Playing Defense: Staying on Top of Your Disaster Recovery Game
- When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing... All Security Webcasts
