HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED ABOUT A MINUTE AGO.
You are here: Home / Microsoft/Windows / Drowning in IE Watering Hole Attack
Security Pros Warn of Drowning in IE 'Watering Hole' Attack
Security Pros Warn of Drowning in IE 'Watering Hole' Attack
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
FEBRUARY
14
2014

Microsoft has confirmed a report of an Internet Explorer zero-day exploit. Redmond also confirmed it is being leveraged in an active campaign attack. Version 10 of IE is reportedly vulnerable to the so-called watering hole attack.

“FireEye Labs has identified a new Internet Explorer (IE) zero-day exploit hosted on a breached Web site based in the U.S.,” FireEye wrote in a blog post on Thursday. “It’s a brand new zero-day that targets IE 10 users visiting the compromised Web site -- a classic drive-by download attack. Upon successful exploitation, this zero-day attack will download a XOR encoded payload from a remote server, decode and execute it.”

How the Watering Hole Works

FireEye first discovered what it has dubbed “Operation Snowman” on Feb. 11. The zero-day exploit targets CVE-2014-0322 and is being served up from the U.S. Veterans of Foreign Wars’ Web site.

“We believe the attack is a strategic Web compromise targeting American military personnel amid a paralyzing snowstorm at the U.S. capitol in the days leading up to the Presidents Day holiday weekend,” the firm reported. “Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns.”

Here’s how it works: After compromising the VFW Web site, the attackers added an iframe into the beginning of the Web site’s HTML code that loads the attacker’s page in the background, FireEye explained. The attacker’s HTML/JavaScript page runs a Flash object, which orchestrates the remainder of the exploit.

FireEye said the exploit includes calling back to the IE 10 vulnerability trigger, which is embedded in the JavaScript. Specifically, visitors to the VFW Web site were silently redirected through an iframe to the exploit at www.[REDACTED].com/Data/img/img.html.

No Out-of-Band Patch Required

We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the zero day. He told us past versions of IE have earned a bad reputation for IE and news reports of new zero-days like this one don't help.

“The truth is that recently, IE has had fewer issues per year than other browsers,” he said. “It's just a common target due to the number of users it has.”

Reguly said Websense and FireEye have both released details on the zero-day with different noted targets, which makes him wonder if other sites are affected and how wide spread the exploit code is. He suspects we'll start to see more now that it's publicly discussed.

“While I'd normally be the first to call for an out-of-band Microsoft patch, I don't think this attack requires one,” Reguly said. “Users should upgrade to IE 11 and if they're stuck on 10 (i.e., Vista), they should install EMET because the exploit code will terminate if it sees that the Enhanced Mitigation Experience Toolkit (EMET) is installed.”

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Barium Ferrite Is The Future Of Tape: Barium Ferrite (BaFe) offers greater capacity, superior performance, and longer archival life compared to legacy metal particle (MP) tape. Click here to learn more.
MORE IN MICROSOFT/WINDOWS
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
An easily avoided security lapse -- failure to use two-factor authentication on a single server -- is being blamed for the massive computer breach that hit JPMorgan Chase this past summer.

ENTERPRISE HARDWARE SPOTLIGHT
Flying under the radar just before Christmas, HP has launched a new version of its Chromebook 14, most notable for its touch screen and full high-definition display, plus more powerful specs.

MOBILE TECHNOLOGY SPOTLIGHT
The Rockstar Consortium backed by Apple, Microsoft, BlackBerry, Sony and Ericsson, just sold the smartphone patents it was holding to the RPX Clearinghouse for $900M.
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.