Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/13/2009
03:03 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Internet Explorer Hit With 1-2 Punch Of Zero-Day Attacks

It's Monday: Do you know what Web browser your users are running? If it's Internet Explorer, don't look now, but for two weeks in a row, IE has taken two jabs straight to the face with ActiveX zero-day exploits that let attackers stomp all over users who are tricked into clicking on a malicious link or get redirected from a compromised site. Browser alternatives starting to look a little more enticing?

It's Monday: Do you know what Web browser your users are running? If it's Internet Explorer, don't look now, but for two weeks in a row, IE has taken two jabs straight to the face with ActiveX zero-day exploits that let attackers stomp all over users who are tricked into clicking on a malicious link or get redirected from a compromised site. Browser alternatives starting to look a little more enticing?I'm not a fan of browser bigots that are always quoting browser usage statistics, but the fact remains that there are many more users of IE than other browsers like Firefox, Safari, and Chrome. Why is that? Are corporate environments locked into using IE because of a particular application that the company is dependent upon? I'm sure a few of you are slowly nodding your heads.

I've seen it before, and unfortunately, a little too close to home, where older versions of IE and Firefox were required because the Web app designers were inept...or, let's be kind and instead say that they were too busy working on important, mission-critical features to focus on meeting standards and compatibility requirements for newer browsers.

Enterprises that have made the decision to stick with IE because it's comfortable and known, or because it's required for their Web application, might want to reconsider their decision. Last week, it was a vulnerability in an ActiveX Video Control, and today it's a Office Web Components ActiveX Control. Other browsers have vulnerabilities, but let's face it -- which is a more likely target, an IE or Firefox user?

The biggest thing going against these actively exploited vulnerabilities is that they can't go beyond the privileges of the user running Internet Explorer. That's good news for those of you practicing the principle of least privilege as discussed in "Least-Privilege Technology Still Swimming Upstream, But Making Progress," but we all know that's not everyone.

What else can you do? There are a few different approaches that can be taken. For example, if you must use IE, then disable all ActiveX controls unless they are absolutely required (this can get cumbersome if you make the wrong choices and have to keep enabling ones you were wrong about). Two browsers could be installed -- with IE can be restricted to only allow access to the legacy apps, while another browser could be used for browsing the Web. Another browser could be used entirely, and the user agent changed whenever accessing the legacy app. A great example of the last option is Firefox and the User Agent Switcher add-on, which I've found works surprisingly often.

I guess what it comes down to is what level of risk are you comfortable taking. Do you use a browser that's less likely to be targeted, or do you go with one that can be better managed centrally? And can you be sure your antivirus and IPs would prevent an attack before it gets to the vulnerable browser? Tough questions.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
CVE-2019-10764
PUBLISHED: 2019-11-18
In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which m...
CVE-2019-19117
PUBLISHED: 2019-11-18
/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter.