New IE Vulnerability Found In The Wild; Sophisticated Web Exploit Follows
New advanced persistent threat leverages IE browser flaw, FireEye researchers say
A new security vulnerability in Microsoft's Internet Explorer has been discovered, and attackers have already used it to create a sophisticated exploit, according to researchers at FireEye.
In a blog posted Monday, FireEye researchers disclosed a memory access vulnerability that works on Windows XP with IE 7 and 8, as well as Windows 7 with IE 9. The vulnerability enables attackers to compromise IE machines that access a malicious website.
"The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution," the blog states. The attack infects cracks in a Windows machine at the DLL level, enabling it to infect the machine with a large, multistage shellcode payload, the researchers say.
In a separate blog, the researchers describe a sophisticated exploit found in the wild that uses the newly discovered vulnerability.
"Specifically, the attackers inserted this zero-day exploit into a strategically important website known to draw visitors that are likely interested in national and international security policy. We have identified relationships between the infrastructure used in this attack and that used in Operation DeputyDog," an attack that infected a number of organizations in Japan in September, the researchers say.
"Furthermore, the attackers loaded the payload used in this attack directly into memory without first writing to disk -- a technique not typically used by advanced persistent threat [APT] actors," the blog says. In-memory attacks generally cannot be detected by traditional anti-malware tools, FireEye notes.
"This technique will further complicate network defenders' ability to triage compromised systems using traditional forensics methods," the blog states.
John Prisco, CEO of security vendor Triumfant, agreed. "In-memory attacks steal your intellectual property faster than the response time of a manual technique relying on signatures and prior knowledge," he said.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024