Slashdot Mirror
New IE Zero-Day Being Exploited In the Wild
wiredmikey writes "A new zero-day vulnerability affecting Internet Explorer is being exploited in the wild affecting IE 9 and earlier. The vulnerability, if exploited, would allow full remote code execution and enable an attacker to take over an affected system. Security researcher Eric Romang discovered the vulnerability and exploit over the weekend while monitoring some infected servers said to be used by the alleged Nitro gang. To run the attack, a file named 'exploit.html' is the entry point of the attack ... According to analysis by VUPEN, the exploit takes advantage of a 'use-after-free vulnerability' that affects the mshtml.dll component of Internet Explorer. Rapid7 on Monday released an exploit module for Metaspolit which will let security teams and attackers alike test systems."
I'm shocked. Shocked I tell you.
Once it's in Metasploit its not a zero-day anymore. Microsoft has already had a few hours to deal with this threat, and system administrators are starting to find out about it, so if you want to exploit it, you're going to run into people who have blocked your exploit because they know about it. That means its not a zero-day anymore.
If an exploit is reported on Slashdot, it is by definition no longer a zero-day exploit.
... as long as it doesn't strike in those first few minutes where I have a freshly installed system and am using IE to download FIrefox (IE is great for this, by the way!) ... then I should be safe!
Been saing for years that if we'd just get rid of day zero on the calendar that so many security concerns could be solved, but instead we get yet another vulnerability. How did this happen on day 260?
Both.
The underlying flaw affects IE 9 and earlier, and from what has been seen so far, the in-the-wild exploit only targets IE 8 and 7 on Windows XP only, Bekrar said.
“The vulnerability was probably found by fuzz testing and its exploitation was trivial on Windows XP,” Bekrar added.
One of these devs was on the job.
sysadmins and parents of newborns get the same amount of sleep.
After all, you're right - there sure seem to be a lot of Day 0 vulnerabilities. If programming languages just started counting from 1 like sensible people do, this could all be avoided.
#DeleteChrome
of shoddy browser security. Could this not be "solved" with proper sandboxing? If there's legacy code to support (this has been cited many times in the past for reasons why), please, please fork IE into two branches: IE Classic or whatever that's fully backwards compatible, and an IE Lite that's completely sandboxed and locked down for wide-spread corporate deployment.
body massage!
They (as in the bad guys) named their main attack vector "exploit.html?" Yeah -- nothing suspicious-sounding about that one.
I have a question. Does the exploit work on Win 7 machines or just Win XP?
Yes I RTFAed. It doesn't really spell out what combo of IE and Windows are vulnerable.
"There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed H
From TFA:
First, a file named “exploit.html” appears to be the entry point of the attack, which loads “Moh2010.swf”, an encrypted Flash file that it decompress in memory.
According to AlienVault's Jaime Blasco, the payload dropped is Poison Ivy, as was the case with the previous Java zero-day. Poison Ivy is a remote administration tool (RAT) that was used the Nitro attacks that targeted chemical and defense companies. Interestingly, after exploitation, the attack loads “Protect.html”, a file that checks to see if the Web site is listed in the Flash Storage settings, and if it is, the Web browser will no longer be exploited despite additional visits to the malicious site.
Namaste
Some say a diamond is forever.
I'd say the same about "the zero-day season" at least with respect to systems like Windows as we know it + commonly used 3rd party applications as we know them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Running web browsers in a well-written sandbox with only very careful access to "the outside machine" will help keep browser bugs from turning into system-wide vulnerabilities.
Sure, someone may take over your browser and turn it into DNS-generation-engine, but once you quit your browser, anything left over will require a social-engineering attack ("download catpics.exe and after you quit your browser, run it!") to continue living.
While no sandbox is perfect, there is (hopefully) a smaller and better-engineered code base to maintain.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If there are no practical, well-understood or at least vendor-supported work-arounds, then for the vast majority of people, it's still a "zero-day."
Hopefully MS and the other affected vendors (e.g. Adobe) will announce a practical work-around within a day or two.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I think this actually requires you to visit a poisoned web site.
So, unless the web site or torrent that you are getting Firefox from is compromised, you should be okay.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
How is that possible? Isn't "new" and "zero-day" mutually exclusive?
Yes I RTFA and didn't see any information on whether IE9-64 is affected. Pretty lousy of the tester to not bother indicating if the problem is only with the 32bit version as the 64bit has a better baseline security configuration. Due to these issues, it's just one of the reasons I also use Palemoon64. Improved security such as full ASLR along with DEP support so I'm hopefull this does not affect IE9-64 due to the limited number of folks actually using it.
Mod me up/Mod me down: I wont frown as I've no crown
I thought PCs didn't get viruses?
Oh wait, that was Macs.
I've used Opera for ages, I feel it's the best on the market, but there's security through obscurity
Sadly Opera allows this security.
So as long as I don't visit a page called exploit.htm I should be ok?
Isn't IE that tool people use to download Firefox?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
does anyone actually use IE when they don't have to?
stephen
IE 7 - 9 in all versions of Windows. However, flash is used for the exploit
Does this exploit work if you're running a modern Internet security suite such as the new Norton Internet Security 2013 with all anti-malware definitions up to date? Mind you, my default web browser on my desktop and laptop is Google Chrome 21.0.1180.89, the current "stable" release version.
But I thought they turned on that "Do Not Hack" HTTP header??
Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.-rms
This exploit gains the privileges of the running user on Windows Vista and 7. The entire point of all the "allow/deny" popup BS with UAC was because they wanted to restrict processes to the lowest privilege necessary. IE is supposed to be a high-risk, sandboxed application and yet this exploit magically gets around it and gains access to the full user's account, which probably has admin rights on the machine. MS does not understand security. You don't start out by giving a user admin rights, you make them ask for it, a la 'sudo'. UAC starts out by keeping the user an administrator, and dropping the rights for new processes and trying to intercept when those processes need higher access so that the OS can display a verification prompt. Since Vista, this has been exploited over and over again. The only way to be safe under windows is to always use a low-priv account, and type in the full username/password of an administrator whenever the UAC prompt comes up, and that is a terrible user experience.
True, true. And simple also. Just have all the routers do DPI on the traffic, and if it is from a Windows machine, then just drop the packet.
You are being MICROattacked, from various angles, in a SOFT manner.
M$ has made laziness and convenience a virtue. Lots of people, especially those who control some money, think computers should require zero intellectual investment. The Philosophy Of Dumbing Down.
By using C or C++, lots of security risks come from rather mundane tasks such as parsing HTML or XML. A C buffer overflow allows for code injection and it can happen in a CSV parser as much as in a JS engine. Yes, more code normally means more problems. But it has little to do with scripting. You can turn off scripting and plugins in many browsers already. But it won't protect you from what is still enabled - HTML parsing, layouting, image libraries, CSS and so on. There have been exploitable bugs in JPEG and GIF libraries. Stop using C and C++ would be the right thing to do. Search for "Memory Safe Language", if you want to research the subject. Too many C and C++ developers think that they are better than average and will never write exploitable bugs. Of course that is a fallacy.
I wonder, given many people here are convinced it's a dying product, why a story like this makes the front-page? Either IE is popular so news like this is important, or IE is a side-lined product that has no relevance...it seems that narrative changes depending on if the news is good or bad.
I find it curious we rarely hear about new major product releases from MS, but the second there's a vulnerability it's the top story. Are we interested in IT or just IT that isn't MSFT tech? There's a difference.
Meh, what am I saying. This place is unashamedly like the Fox News of IT - interested in a narrative only, not reality. Flame away.
throw new NoSignatureException();
Would this be usable on xbox-es running the beta fall update?
One of the two features its featuring is IE (the other some f2p mmofps).
This has been around for years! The 2008 Antivirus virus is a grand example of this. And I do believe Microsoft knew about this years ago. In 2009 the virus changed its name, and again in 2011 and 1012. There is a new form of the virus out which displays a fake FBI screen, which you can not do anything about untill you pay. ( unless you are technically inclined, or happen to know someone who is). I Cant believe this is just now getting attention... Oh wait, this is MS, I am talking about.. I guess I do believe it.
The exploit allows the virus to attack. The "drive by" has been around since 2008. Look at the antivirus virus, there is also a couple of FBI virus. They lock you out of your stuff, change your settings, mark every folder and file on your computer as hidden. From what I can tell its a flaw in the way IE allows Flash to use the browser. Then the real hole, is how windows, allows IE to "make changes" to the kernal. If everything HAD to be downloaded and installed manually, this would not be an issue. Or if FLASH, would step up to the plate and fix their stuff, ( including but not limited to, adding itself to boot when windows runs, having an installer constantly running in the background, having the updater, check for updates every 7-10 mins, not allowing any form of settings to control the program), then there would not be a problem. If you ask me This "new security hole", should be pushed back on flash to fix their crap. Flash is basically a virus that dont break anything to the point of unfixable. They use their script to fix what they break when they break it.
Install Linux.
me space lizard cavemoon, ask wild can't put any file into emet 3.5?
where in software lizard garden grows the rare emet 3.6 dll file nutrient we need so badly?
me space lizard cavemoon, say no more trade with freckled fraced white moons of Earth
may great space lizard shove incompatible mandrake rpm's up your bung holds, through wget and rpmupdate
Indeed, Java is far from being well-implemented. I could reliably crash it when running the YaCY distributed search engine. It would pull a PDF from the internet and try to parse it using a Java-based parser. That would kill the JVM. I blame it on SUN/Oracle not having a strong incentive to get the JVM right.
I am in general not a fan of Java and designed a language of my own memory safe language called Sappeur. Sappeur is essentially a safe subset of C++. It does not need a VM, which means Sappeur programs can launch in milliseconds and don't have these GC freezes. It took me a bit more than 10000 lines of C++ code to implement the compiler, as the compiler generates C++ code and actual machine code generation is done by GCC or msvc.
So, the memory-safety property depends mainly on about 10k lines of code (LOC), which is not much. According to wikipedia, the SUN JVM is 250k lines of code. It is evident that proving the correctnes of 10k LOC is much more feasible than proving 250k LOC.
When it comes to security, Simple And Stupid approaches are always the most robust ones. If the software industry really wanted top-notch security, we could drop our addiction to C and C++ and we could get simple, yet effective solutions. We could mathematically prove correct things like Sandboxes and compilers. Google and M$ could afford it. It just does not contribute to the next quarterly results. It might destroy the quarterly results in three years if we don't do anything. But that is not how managers think.
Finally, every Security Line Of Defense is valuable and should be employed. We can't even expect MMUs to be implemented correctly. Defense in Depth - that is what we need. So: Memory Safe Language // Sandbox // MMU+OS - that is much better than just two or one layer of defense.
After all, trolls: Your having to downmod my posts here unjustifiably on computing technical grounds:
http://tech.slashdot.org/comments.pl?sid=3124197&cid=41374257
http://tech.slashdot.org/comments.pl?sid=3124197&cid=41374807
http://tech.slashdot.org/comments.pl?sid=3124197&cid=41376221
http://tech.slashdot.org/comments.pl?sid=3124197&cid=41377421
?
* That's pretty "piss poor" on your parts, "hit & run" unjustifiable downmod using trolls... Especially since you can't justify how & on what grounds you did so!
APK
P.S.=> YOU know it, I know it, & again - by THIS point? So does anybody else reading...
... apk
http://support.microsoft.com/kb/2744842
* And, there you go... done!
APK
P.S.=> MS fixed this issue, & 4 others along with it... bonus!
... apk