Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/6/2013
01:35 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack

Other U.S. energy agencies, organizations targeted in apparent nuclear technology cyberspying campaign that employed a zero-day bug in Internet Explorer 8

A targeted attack discovered last week serving up malware from the U.S. Department of Labor's (DOL) website employed a previously unknown vulnerability in Internet Explorer 8 that Microsoft says it will fix either with an emergency patch or via its monthly patch process.

And as is tradition, Metasploit also has quickly added an exploit pack for the new flaw, a use-after-free bug that has been assigned as CVE-2013-1347. "Microsoft is investigating public reports of a vulnerability in Internet Explorer 8. Microsoft is aware of attacks that attempt to exploit this vulnerability," a security advisory issued by Microsoft late on Friday said. "Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability."

Security researchers at AlienVault Labs and Invincea initially attributed the exploit to a patched bug in IE 8, CVE-2012-4792, but further investigation into the attacks found it was a new flaw. FireEye is credited with reporting the find to Microsoft.

At least nine additional websites in addition to the DOL were hit with the attack simultaneously, according to Jaime Blasco, director of AlienVault research labs. Blasco said in a blog post over the weekend that nonprofit organizations and a large European aerospace, defense, and security company were among the websites hit in the waterhole campaign.

[Broader spearphishing campaigns and watering-hole attacks look to compromise and gather intelligence on broader classes of targets. See Expect Less Targeting From This Year's Targeted Attacks .]

It appears the attackers were using the DOL attack to turn around and target the U.S. Department of Energy. According to Invincea, "the web pages that were compromised on the DoL site are intended for Dept of Energy employees (and their DoL representatives) in dealing with nuclear-related illnesses linked to Dept of Energy facilities and the toxicity levels at each location," and the campaign "is now widely believed to be a watering hole attack that involves compromising one Federal Dept (DoL) to target another (DoE)."

Matt Dahl, senior threat researcher for CrowdStrike, says the likely ultimate targets visiting the uranium-focused DOL site would be U.S. government agencies involved in energy, energy companies, and "possibly companies in the extractive sector," he said in a blog post.

Of the visitor traffic to the infected DOL site, 71 percent were IP addresses out of the U.S., 11 percent were out of Southeast Asia, and 10 percent were out of Europe. But it's unclear whether the malware actually was exploited on all of those machines.

Dahl stopped short of confirming that the infamous Chinese cyberespionage group DeepPanda is behind the attacks, noting that it was unable to confirm this because the command-and-control server is offline. AlienVault's Blasco last week discovered that the command-and-control protocol used in the attack matches a backdoor used by DeepPanda, which is known for stealing information from defense, energy, and chemical entities.

The DOL's website was infiltrated with malicious code planted on its website, which then sent victim machines to a malicious server that was spreading the PoisonIvy remote access Trojan. A JavaScript tag on the website leads via an iFrame to the browser exploit.

IE 8 running on XP, Vista, Windows 7, Server 2003, and Server 2008 are all affected by the new zero-day.

Security experts recommend moving to IE 9 or 10, and for XP users to run Chrome or Firefox until Microsoft has issued a fix for the bug.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
thernningmn
50%
50%
thernningmn,
User Rank: Apprentice
5/27/2013 | 4:04:18 AM
re: Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack
Well the US government is at least a year behind with anything. A majority of federal and DoD government websites required for time cards, training, and other commitments will not work with any browsers newer than IE8. Hence the reason to attack a "government" website. Someone may know this and is the reason they used this particular attack.
Ashu001
50%
50%
Ashu001,
User Rank: Apprentice
5/7/2013 | 8:14:05 PM
re: Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack
I was thinking precisely the same thing.

Especially when IE9 has seen such wide release.

Such companies deserve to be hacked(IMHO).
Larry Seltzer - UBM Tech
50%
50%
Larry Seltzer - UBM Tech,
User Rank: Apprentice
5/6/2013 | 6:12:24 PM
re: Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack
How can any organization still be running IE8?
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8071
PUBLISHED: 2019-10-17
Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-10752
PUBLISHED: 2019-10-17
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
CVE-2019-12611
PUBLISHED: 2019-10-17
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupn...
CVE-2019-13657
PUBLISHED: 2019-10-17
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
CVE-2019-15626
PUBLISHED: 2019-10-17
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.