2 Different Hacker Groups Exploit The Same IE 0-Day

Use Netsparker


It hasn’t been too long since the last serious Internet Explorer 0-day, back in November it was used in drive-by attacks – Another IE 0-Day Hole Found & Used By In-Memory Drive By Attacks.

And earlier last year there was an emergency patch issued – Microsoft Rushes Out ‘Fix It’ For Internet Explorer 0-day Exploit.

This time though it seems two different groups have figured this one out and have developed attack code independently, that ended up pretty similar (which is not surprising considering it’s attacking the same exploit).

Two different hacker groups are exploiting the same still-unpatched vulnerability in Internet Explorer (IE) with almost-identical attack code, a security researcher said Tuesday.

The attacks, the first campaign unearthed last week by FireEye and a second campaign found by Websense, exploit a flaw in IE9 and IE10, two editions of Microsoft’s browser. Attacks have been spotted targeting only IE10, however.

According to FireEye, the attacks it found targeted current and former U.S. military personnel who visited the Veterans of Foreign Wars (VFW) website. Meanwhile, Websense reported that the exploit it discovered had been planted on the website of a French aerospace association, GIFAS (Groupement des Industries Francaises Aeronautiques et Spatiales), whose members include defense and space contractors.

GIFAS is best known to the public as the sponsor of the Paris Air Show, where commercial and military aircraft makers strut their newest fixed-wing planes and helicopters.

Aviv Raff, chief technology officer at security firm Seculert, contended that the attacks uncovered by FireEye and Websense were the work of two gangs.


The attack will work on both IE9 and IE10, but it seems the groups are only targeting IE10 for some reason. Also it seems to be targeting defense/military related targets via related websites. It is possible both groups are using the same attack code though purchased through the black market and customised to their particular purpose.

IF people are already using IE11 though (which is heavily pushed in Windows 7/8 updates) they will be safe against this particular attack.

Raff confirmed that Seculert believed two different groups of cyber criminals were at work, both leveraging the same IE zero-day vulnerability, in an interview conducted via instant message Tuesday.

“We do see similar variations of zero-day exploits, but zero-day [vulnerabilities] that were never publicly disclosed before, that is not that common [for two groups to use simultaneously],” Raff said in that interview.

He speculated that the two hacker gangs probably obtained the attack code from the same third-party by purchasing it on the black market. “The elements of the exploits are almost identical,” Raff added, explaining his reasoning.

Although Microsoft has acknowledged that both 2011’s IE9 and 2012’s IE10 contain the vulnerability, it has yet to issue an official security, the usual first step towards publishing a patch. Nor has the Redmond, Wash. company’s security team named any temporary defensive measures, which are frequently offered in the “Fixit” format.

Instead, Microsoft has encouraged users to upgrade to IE11, which is immune to the attacks. However, Windows Vista owners running IE9 cannot migrate to IE11 as the latter does not support the little-used Vista.

Raff also said Seculert’s research had found that the malware used in the GIFAS campaign had changed the hosts files of the infected machines to redirect any remote access software traffic through the hackers’ servers so that they could steal log-on credentials.

“The domains that were added to the hosts file by the malware provide remote access to the employees, partners, and third-party vendors of a specific multinational aircraft and rocket engine manufacturer,” said Raff on the blog.

This case appears to be quite a focused attack though and the zero day isn’t being used to do drive by malware installation, or to build a botnet. Although now the exploit code is out there, I don’t see that kind of activity being too far behind.

It’ll be interesting to see if Microsoft consider this serious enough to push an out of band patch out before the next patch Tuesday rolls around.

Source: Network World

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , , , , , , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Comments are closed.