Hackers exploit unpatched IE bug with drive-by attacks
Microsoft confirms hackers targeting IE6; IE7 also at risk
Computerworld - Microsoft today warned that attackers are targeting Internet Explorer (IE) with an exploit of a critical unpatched vulnerability in all current versions of the browser.
Only IE9, which is still in beta, is unaffected.
Microsoft and others confirmed that attacks are circulating in the wild, primarily targeting IE6, the nine-year-old browser that Microsoft's been trying to kill for more than a year.
"So far, the attacks we have seen only target Internet Explorer 6 and would not have been successful against Internet Explorer 8," said Andrew Roths, Jonathan Ness and Chengyun Chu, three engineers who work on the Microsoft Security Response Center team.
Microsoft downplayed the threat, saying it has seen only "extremely limited" attacks thus far.
The exploit relies on a heap spray to take down IE, said Roths, Ness and Chu. Hackers can hijack Windows PCs by getting users to visit a malicious site, making the threat a classic "drive-by" attack that can instantly commandeer a machine with a vulnerable version of IE.
Although the newer IE8 contains the vulnerability, it's immune to the current round of attacks because it switches on DEP, or data execution prevention, by default. DEP is one of two key defensive measures within Windows -- the other is ASLR, or address space layout randomization -- designed to block attacks, or at least make the hacker work harder.
Antivirus vendor Symantec said that it had first seen exploits aimed at the IE bug several days ago when it came across spam that had been sent to select individuals within some organizations. The messages posed as hotel reservation notifications.
"Within the e-mail, the perpetrators added a link to a specific page hosted on an otherwise legitimate site," said Symantec researcher Vikram Thakur in an entry on his company's blog. "The hackers had gotten access to the Web site account and uploaded content without the owners knowing."
Anyone visiting the hacked site with IE6 or IE7 -- the former doesn't support DEP, while the latter doesn't enable it by default -- is infected with malware that opens a "backdoor" on the compromised computer, then downloads a number of files containing additional commands
Symantec said it reported the bug to Microsoft and reached out to the owners of the server hosting the attack page and malware. That server has since been taken offline.
"The files on this server had been accessed by people in lots of organizations in multiple industries across the globe," said Thakur. "[But] very few of them were seen accessing the payload file, which means that most users were using a browser which wasn't vulnerable or targeted."
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!