Want create site? Find Free WordPress Themes and plugins.

New IE9 and IE10 vulnerability has been discovered and not yet patched. See details below

Code Name: Operation Snowman

Microsoft has confirmed reports of a recently active attack that surreptitiously installed malware on computers running a fully patched version 10 of the Internet Explorer browser. The attacks also work on IE 9, the company warned.

The zero-day exploit was served on vfw[.]org, the official website for the Veterans of Foreign Wars, according to a blog post published Thursday afternoon by security firm FireEye. The people behind the attack compromised the VFW website and then embedded an iframe tag that silently loaded a page on another site that hosted the exploit. While FireEye researchers didn’t identify the second site, Aviv Raff, chief technology officer of Israel-based security firm Seculert, said it was aliststatus[.]com.

These attacks as reported by FireEye and Websense are known as “watering hole attacks” because they involve compromising websites visited by particular groups of people that attackers wish to target — in these particular cases U.S. military personnel and French defense contractors.

This means that Attackers can also install this exploit on sites that request logins e.g. bank websites and use it to extract logins from users.

How it works

After compromising the VFW website, the attackers added an iframe into the beginning of the website’s HTML code that loads the attacker’s page in the background. The attacker’s HTML/JavaScript page runs a Flash object, which orchestrates the remainder of the exploit. The exploit includes calling back to the IE 10 vulnerability trigger, which is embedded in the JavaScript. Specifically, visitors to the VFW website were silently redirected through an iframe to the exploit at www.[REDACTED].com/Data/img/img.html.

The exploit targets IE 10 with Adobe Flash. It aborts exploitation if the user is browsing with a different version of IE or has installed Microsoft’s Experience Mitigation Toolkit (EMET). So installing EMET or updating to IE 11 prevents this exploit from functioning. Also applying the MSHTML Shim Workaround prevents the exploitation of this 0-day, albeit temporarily

How to fix it

Microsoft published a security advisory about the vulnerability, which is tracked as CVE-2014-0322, and released a “Fix It” tool as a temporary workaround. However, the company has not yet released a regular patch through the regular Windows update channel.

The security advisory can be viewed at http://technet.microsoft.com/en-us/security/advisory/2934088 which also contains detailed steps on the workaround

A permanent fix advised by Microsoft is to upgrade to Internet Explorer 11, or switch to other browsers like Google Chrome Enterprise (for domain deployment)

Sources

http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html

http://technet.microsoft.com/en-us/security/advisory/2934088

You can follow the author on his blog http://androidphoneappreviews.com (for tech news that matter) or http://echo.com.ng (for free tech support and repairs), or on twitter (@kcemenike), or facebook (http://facebook.com/echosolutionsng)

Enhanced by Zemanta
Did you find apk for android? You can find new Free Android Games and apps.

Leave a Reply