Researchers Remotely Defeat IE Protected Mode

Microsoft Internet Explorer 9 Beta Revealed

A previously undisclosed vulnerability allows attackers to bypass Protected Mode on both Internet Explorer 7 and 8. The flaw was discovered by researchers at managed services firm Verizon Business, which is part of Verizon Communications.

The related attack works by escalating the browser's privilege level from low to medium integrity. "Once the initial, remote exploit has been used to execute arbitrary code at low integrity on the client, the payload can create a web server listening on any port on the loopback interface," according to the Verizon Business researchers. This web server then serves an attack locally, which the browser typically grants medium integrity, because it's being rendered in the Local Intranet Zone. At that point, repeating the attack can introduce persistent malware, because the medium-integrity setting allows for code to persist.

Since Internet Explorer 7 and Windows Vista -- which added User Account Control (UAC) -- Microsoft has offered a Protected Mode for IE, meant to stop these types of attacks. Furthermore, this mode, which is activated by default for all non-local browsing, has been pitched by Microsoft as a last-ditch defense for ensuring that even if malicious code compromises IE, Protected Mode will prevent the code from being able to persist or do much damage.

Except that according to the new report, Protected Mode doesn't appear to be doing that.

According to the Verizon Business researchers, this begs the question of how much protection Protected Mode is really supposed to do. "The fact that a single exploit can be used for both the remote exploit and local privilege escalation is central to why this is a significant issue," they said in their related report, "Escaping from Microsoft's Protected Mode Internet Explorer." The report says, "features such as Protected Mode can only be effective if they either significantly raise the cost of an attack, or reduce the probability of a successful attack." But this feature doesn't appear to do either very reliably.

Even so, Verizon Business researchers said that Protected Mode is helpful, since "currently, most malicious code that runs at low integrity will likely fail to persist across reboots, since it will not be aware that it is running at low integrity." For example, they said, the Metasploit Framework, an open source penetration testing toolkit with the world's largest database of publicly tested exploits, is mostly not aware of integrity level.

But the Verizon Business researchers called on vendors such as Microsoft to separate their products' security features and functionality from marketing hype. "Microsoft and other software vendors should clearly document which features do and do not have associated security claims. Clearly stating which features make security claims, and which do not, will allow informed decisions to be made on IT security issues. This will benefit vendors, customers and even security researchers."

For Further Reading

Internet Explorer Vulnerable To Browser History Hijacking

Microsoft Issues Zero-Day IE Warning

UniBrows Adds Security To Internet Explorer 6 Apps