Vulnerabilities / Threats
09:27 AM

IE, Chrome Browser Attack Exploits Windows PCs

Microsoft says the social-engineering vulnerability, which uses "pop-under" browser notifications and a fake Captcha, isn't a Windows bug.

Might Microsoft issue a patch to lock down the Windows user interface and block these types of attacks? In fact, Microsoft has issued a statement saying that it doesn't see the related Windows behavior as constituting a vulnerability. It also said that browser security tools, such as the Smart Screen filter first introduced with IE8, will help block related exploits.

"We are aware of this industry-wide social engineering technique that requires user interaction to run a malicious application," according to Microsoft's statement. "This is not a vulnerability, as someone must be convinced to visit a malicious site and take additional action, such as using a keyboard shortcut to execute the malicious application. Smart Screen will help mitigate the risk for customers running Internet Explorer. We continue to encourage customers [to] exercise caution when visiting untrusted websites."

But Valotta said Microsoft's Smart Screen technology isn't infallible. "There are a lot of ways to circumvent Smart Screen," he said. One technique would be to use a stolen extended validation signing certificate to give the malware a good reputation. Another technique is to use extweets -- shortened URLs made to link to malicious executables -- of which Valotta said about 20% don't appear to be on Microsoft's list of bad code, or classified as malware by Virus Total.

Microsoft Windows User Access Control (UAC) settings can also help block attacks that target the notification-mechanism vulnerabilities, for example by flashing a warning -- above all other windows -- whenever an application requests administrator privileges. But Valotta said that admin-level access isn't required to do damage, and cites malware such as Carberp that's able to inject JavaScript and HTML into the client browser to make it appear to be a legitimate site.

How might Microsoft or Google lock down Windows or their respective browsers to block these types of attacks? Valotta offered several recommendations, including altering browsers so that any notifications tied to background windows be brought to the front after a preset period of delay, as well as disabling use of the tab key in notification windows and ensuring that all important notifications -- for example, file-download alerts -- are displayed in a static browser frame that can't be hidden in a pop-under window.

2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
6/29/2013 | 5:55:50 PM
re: IE, Chrome Browser Attack Exploits Windows PCs
This is clearly a browser bug. As soon as a notification gets shown the window needs to be active and in the front. But is easier to blame others than fix the own flaws.
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio