Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Researchers Remotely Defeat IE Protected Mode

Attackers can bypass the Microsoft browser's sandbox and install persistent malware, according to researchers at Verizon Business.

Microsoft Internet Explorer 9 Beta Revealed
Slideshow: Microsoft Internet Explorer 9 Beta Revealed
(click image for larger view and for full slideshow)
A previously undisclosed vulnerability allows attackers to bypass Protected Mode on both Internet Explorer 7 and 8. The flaw was discovered by researchers at managed services firm Verizon Business, which is part of Verizon Communications.

The related attack works by escalating the browser's privilege level from low to medium integrity. "Once the initial, remote exploit has been used to execute arbitrary code at low integrity on the client, the payload can create a web server listening on any port on the loopback interface," according to the Verizon Business researchers. This web server then serves an attack locally, which the browser typically grants medium integrity, because it's being rendered in the Local Intranet Zone. At that point, repeating the attack can introduce persistent malware, because the medium-integrity setting allows for code to persist.

Since Internet Explorer 7 and Windows Vista -- which added User Account Control (UAC) -- Microsoft has offered a Protected Mode for IE, meant to stop these types of attacks. Furthermore, this mode, which is activated by default for all non-local browsing, has been pitched by Microsoft as a last-ditch defense for ensuring that even if malicious code compromises IE, Protected Mode will prevent the code from being able to persist or do much damage.

Except that according to the new report, Protected Mode doesn't appear to be doing that.

According to the Verizon Business researchers, this begs the question of how much protection Protected Mode is really supposed to do. "The fact that a single exploit can be used for both the remote exploit and local privilege escalation is central to why this is a significant issue," they said in their related report, "Escaping from Microsoft's Protected Mode Internet Explorer." The report says, "features such as Protected Mode can only be effective if they either significantly raise the cost of an attack, or reduce the probability of a successful attack." But this feature doesn't appear to do either very reliably.

Even so, Verizon Business researchers said that Protected Mode is helpful, since "currently, most malicious code that runs at low integrity will likely fail to persist across reboots, since it will not be aware that it is running at low integrity." For example, they said, the Metasploit Framework, an open source penetration testing toolkit with the world's largest database of publicly tested exploits, is mostly not aware of integrity level.

But the Verizon Business researchers called on vendors such as Microsoft to separate their products' security features and functionality from marketing hype. "Microsoft and other software vendors should clearly document which features do and do not have associated security claims. Clearly stating which features make security claims, and which do not, will allow informed decisions to be made on IT security issues. This will benefit vendors, customers and even security researchers."

For Further Reading

Internet Explorer Vulnerable To Browser History Hijacking

Microsoft Issues Zero-Day IE Warning

UniBrows Adds Security To Internet Explorer 6 Apps

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-05
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
PUBLISHED: 2019-12-05
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
PUBLISHED: 2019-12-05
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.
PUBLISHED: 2019-12-05
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
PUBLISHED: 2019-12-05
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate c...