Tweet
divdiv class=postBody txtWrap section=txt readability=29pA pair of vulnerabilities in Internet Explorer currently being exploited in the wild to install malware on computers that visit at least one malicious Web site, security researches warn./ppThe classic drive-by download attack targets the English versions of IE 7 and 8 in Windows XP anda href=http://download.cnet.com/Internet-Explorer/3000-2356_4-10013275.html section=luke_topic IE 8/a ona href=http://www.cnet.com/windows-7/ section=luke_topic Windows 7/a, security firm FireEye warned in a company a href=http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.htmlblog post/a Friday. However, the security researcher wrote that its analysis indicated that other languages and browser version could be at risk. /ppThe exploit targets the English version of Internet Explorer, but we believe the exploit can be easily changed to leverage other languages, FireEye researchers Xiaobo Chen and Dan Caselden wrote. Based on our analysis, the vulnerability affects IE 7, 8, 9 and 10. /ppThe second of the two holes is an information leakage vulnerability that is used to retrieve the timestamp from the program executable's header./ppThe timestamp is sent back to the attacker's server to choose the exploit with a ROP chain specific to that version of msvcrt.dll, the pair wrote. This vulnerability affects Windows XP with IE 8 and Windows 7 with IE 9./ppThe exploit's ROP chain, or return-oriented programming, is a technique for disguising executable code from security defenses. /ppFireEye wrote in a a href=http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.htmlfollow-up post/a that further analysis found that the exploit was part of an advanced persistent threat (APT) in which attackers inserted the exploit code directly into a strategically important website, known to draw visitors that are likely interested in national and international security policy./pp Further distinguishing this exploit from others is that the payload was delivered without first writing to disk, a technique that will further complicate network defenders' ability to triage compromised systems, using traditional forensics methods, the researchers wrote./ppSpecifically, the payload is shellcode, which is decoded and directly injected into memory after successful exploitation via a series of steps, FireEye researchers wrote in the latest post. By utilizing strategic Web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive. APT actors are clearly learning and employing new tactics./ppFireEye did not identify the affected Web but said the attacks can be mitigated by using Microsoft's Enhanced Mitigation Experience Toolkit (EMET)./pp/p/div/divbrbrcentera href=http://www.wizardrss.comPowered By WizardRSS.com/a | a href=http://www.wizardrss.comFull Text RSS Feed/a | a href=http://www.amazon.com/RFID-Blocking-Cards-Identity-Protector/dp/B00CJHZLEWRFID/a | a href=http://www.wpzonbuilder.comAmazon Affiliate/a/center