Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Researchers Remotely Defeat IE Protected Mode

Attackers can bypass the Microsoft browser's sandbox and install persistent malware, according to researchers at Verizon Business.

Microsoft Internet Explorer 9 Beta Revealed
Slideshow: Microsoft Internet Explorer 9 Beta Revealed
(click image for larger view and for full slideshow)
A previously undisclosed vulnerability allows attackers to bypass Protected Mode on both Internet Explorer 7 and 8. The flaw was discovered by researchers at managed services firm Verizon Business, which is part of Verizon Communications.

The related attack works by escalating the browser's privilege level from low to medium integrity. "Once the initial, remote exploit has been used to execute arbitrary code at low integrity on the client, the payload can create a web server listening on any port on the loopback interface," according to the Verizon Business researchers. This web server then serves an attack locally, which the browser typically grants medium integrity, because it's being rendered in the Local Intranet Zone. At that point, repeating the attack can introduce persistent malware, because the medium-integrity setting allows for code to persist.

Since Internet Explorer 7 and Windows Vista -- which added User Account Control (UAC) -- Microsoft has offered a Protected Mode for IE, meant to stop these types of attacks. Furthermore, this mode, which is activated by default for all non-local browsing, has been pitched by Microsoft as a last-ditch defense for ensuring that even if malicious code compromises IE, Protected Mode will prevent the code from being able to persist or do much damage.

Except that according to the new report, Protected Mode doesn't appear to be doing that.

According to the Verizon Business researchers, this begs the question of how much protection Protected Mode is really supposed to do. "The fact that a single exploit can be used for both the remote exploit and local privilege escalation is central to why this is a significant issue," they said in their related report, "Escaping from Microsoft's Protected Mode Internet Explorer." The report says, "features such as Protected Mode can only be effective if they either significantly raise the cost of an attack, or reduce the probability of a successful attack." But this feature doesn't appear to do either very reliably.

Even so, Verizon Business researchers said that Protected Mode is helpful, since "currently, most malicious code that runs at low integrity will likely fail to persist across reboots, since it will not be aware that it is running at low integrity." For example, they said, the Metasploit Framework, an open source penetration testing toolkit with the world's largest database of publicly tested exploits, is mostly not aware of integrity level.

But the Verizon Business researchers called on vendors such as Microsoft to separate their products' security features and functionality from marketing hype. "Microsoft and other software vendors should clearly document which features do and do not have associated security claims. Clearly stating which features make security claims, and which do not, will allow informed decisions to be made on IT security issues. This will benefit vendors, customers and even security researchers."

For Further Reading

Internet Explorer Vulnerable To Browser History Hijacking

Microsoft Issues Zero-Day IE Warning

UniBrows Adds Security To Internet Explorer 6 Apps


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-10
For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
PUBLISHED: 2020-08-10
An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerabilit...
PUBLISHED: 2020-08-10
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
PUBLISHED: 2020-08-10
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
PUBLISHED: 2020-08-10
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.